you mean like your serverUrl and appId, yes they can see those but they’re not credentials as @cryptokid says 
Just make sure no one gets your masterKey
Hi - to follow up here, is it correct that we can now use our own domain and use Moralis only as the server link to allow us to use Moralis while having functionality at our own domain? Is this included in the free version?