I will send this app to mac store but is it safe to use username and password inside the app as it is needed to connect to database ? Can Mac apps decompiled etc ?
A B4J App is not a Mac App.
A B4J App is based on Java which can be easily decompiled.
You should store the credentials in your php-site and request the data from your app when you need them. You can use ssl connection to secure it. Storing it inside your app is not secure.