Security is always relative however in this case its a little bit more risk. It definitely gives some protection against the database being hacked. I wonder if

Security is always relative however in this case its a little bit more risk. It definitely gives some protection against the database being hacked. I wonder if you allow the user credentials for the sites to be read back by the user on screen? One of the core principals is to never store the password credentials in plain text, however the way the service works you have to store them in plain. Another concern is if the service can read and gather the secrets from both the data stores to make the request then its a matter of some writing an API to leak that information by mistake or intentionally.