Is the app secure?

The app is just as secure as the physical code device as you are able to protect your phone with a personal code. The app replaces the one-code step, but you still need to enter your personal password to complete the identification with BankID. As long as you keep your password for yourself the service is safe.