Security threats are to recieve priority attention and released asap. The source code itself should contain no passwords or user information.

Create and fill out a private security advisery here, or email the repository owner.