Security implications of exposed SSO Secret in multi-user install?

I was going to say “if you know that the secret is compromised, cycle it and move on”; but that doesn’t seem to apply here. Uh, I think the fix is to lock down who can see the plugin settings. Where would that be done? I’m not a WP expert.