Irresponsibility != malice. If your FOSS software uses plaintext passwords because you don't care about data-at-rest security for whatever reason, sure, you're

Irresponsibility != malice. If your FOSS software uses plaintext passwords because you don't care about data-at-rest security for whatever reason, sure, you're not required to make all your public code super secure. Otherwise all student projects uploaded to GitHub would be crimes. If your FOSS software adds a bit of code that POSTs all inputted credit card numbers to https://seba_dos1.com https://seba_dos1.com, well, that's gonna look very different in court. It's like holding a garage sale where you give stuff away for free. Nobody can complain if your old stereo that you gave away for free doesn't work, but if you have an old propane burner that's likely to sear somebody's face off, best to just throw it away.