Looks great, but... how can one trust it with credentials/communication? (nothing against the developer, more the principle of the thing)

ummm, you can read the code...

but you shouldn't trust these unofficial clients, easy way to get your whatsapp account banned