[ilovecats]

The insecurity stems from the fact that the media links (those that you open in VLC for example) either contain your username and password to XBMC's web server, or alternatively they are password-less (if you use a reverse proxy). In the first case, the worst thing that can happen is someone can control your XBMC remotely until you change the password. In the second case, someone who gets his hands on a movie download link can potentially guess the links to other files in your library too.

My advice to you is to not give out access to this application to people that you don't trust.

Thanks. Can I assume that if I disable streaming/downloading of the media (does such an option exist?), and use the server solely for browsing info, there will be no such security concerns?

And when you referred to "XBMC's web server", did you mean the built-in HTTP server of XBMC? Is it required for streaming/downloading via your server?