Client secret should be treated like a password and should be encrypted using bycrypt when stored in the database