What can end-users access from public shiny app?

Hi All, I am a newer to shiny apps and want to clarify exactly what is exposed to end-users or what code is accessible to the outside world when hosting an app on the free tier of shinyapps.io. I have a data refresh in my app that comes from an API call with a personal username and password authentication. I do not want to expose my Username/PW. If this is in the app.R code, will it be accessible in any way? Thank you for clarifying.

Please see this FAQ topic from the RStudio support: