Most "Revealer" or "Mapper" apps require you to type your Facebook username and password directly into their interface to pull API queries. Doing this hands complete access of your profile over to malicious developers.