Giving Secret Key and API key to trading program, a scam?

Good evening folks,Please pardon me if this is a noob question.

​

A family member of mine recently started trying a trading program which links to Binance via API. This program requests Reading and Spot & Margin Trading rights but not withdrawals.

Is this program safe to use? I have some software development experience so I understand that giving API keys are generally safe as long as you restrict the program from withdrawing from your account.

However I lack understanding on the "Secret Key" aspect.
My concern is that the secret key on Binance can be used to edit app permissions in the future.
Is this ever possible?

​

Thank you once again, I am really concerned. Any help would be appreciated, thank you.