Finding accidental and/or malicious information leaks like this is going to be the reality of the next decade or so of open source network service development.

Finding accidental and/or malicious information leaks like this is going to be the reality of the next decade or so of open source network service development. Some will argue that's a reason not to trust open source; but the truth is that leaks and problems are much easier to hide (and thus for organizations to fail to address) in closed source codebases. This hasn't quite reached public perception for some reason - users don't tend to know that many popular videoconferencing tools and social networks are closed source. But I think it is a reasonably straightforward and useful distinction to explain (without claiming that FLOSS software is perfect, which it isn't). Investing in detection tools (at both the code level and network level) is probably a good idea - and the same source availability and leak analysis rules apply to them to (perhaps moreso).