Not directly related to the deprecation of file/string credentials - this is already only supported via ADC or service account / user account credentials in apiary, so there's no security concern.

However, during that audit, I found some issues with our implementation for a few functions - namely CredentialsLoader being used where FetchAuthTokenInterface should be used, and places where the wrong types could be supplied if used incorrectly (see Guzzle6AuthHandler).