[twitter-dev] oAuth consumer keys, tokens...how sensitive are those keys?

[Andriy Ivanov]

I've written Desktop app that uses oAuth to communicate with twitter.
All the keys/tokens/pin I save in Settings file in my project (.NET).
Is it safe to do so or what is the better approach to save this kind
of data? What if all the tokens get in hand of "evil", they can
impersonate the user using the tokens, right? Why won't tokens expire
with Twitter? I am knew to internet protocols, so any help would be
appreciated. Thanks!