One way to maintain the security of your external client apps is to change the OAuth consumer key or secret. Use Connect API to stage, rotate, and delete OAuth credentials.
See Stage, Rotate, and Delete OAuth Credentials for a Local External Client App