That's a valid concern. I'm refactoring the code into a separate module: loopback-passport.