Hence why I said: "open source or not: doesn't matter". The insecurity here is including your application's authentication credentials in any format that is ending up on an unsecured system.