SO with the help of @inertia we found a possible bug. if a node is not up it can store your active key.
We found no keys had been stored, but just in case it would be a good idea to reset your active keys. The possibility of a breach we checked and its very unlikely there was one. You can reset your keys on steemit.com or using the desktop steem wallet Vessel which was made by @jesta
Zappl will also be turning off the ability to use the wallet and update certain section of your profile from the app. Until the browserify method for active key is added. This is in no way means your keys were stolen, but in case in the off chance it did its best to be safe then sorry.
You can see the discussion here: https://steemit.com/zappl/@zappl/re-inertia-re-zappl-re-inertia-re-zappl-re-inertia-re-reggaemuffin-re-inertia-re-zappl-let-zappl-clerify-some-things-fud-correction-20180213t003249874z