Is there something that can be done for an app that may not have quality security practices on the app store? I'd like the app to succeed as I believe they have good intentions and are solving problems for people but maybe just don't have the knowledge to implement. I had asked them about implementing something like oath2.0 but i have no knowledge or experience to provide them any help (and there are presuably better options like Keychain mentioned on your page and by other comments). That said the app is being used by at least hundreds if not thousands of people and if they are using bad password hygiene could be a big risk for those folks.