In terms of security, the sources do not matter much. There are too many ways to compromise the client. Not only it would take immense effort to audit the sources to determine whether something malicious is happening or can happen at least, but the actual binary run on your PC may contain something that was not present in the source code (unless you build the client yourself).
Our repository contains not only the client code but also other things, that I do not plan to make public. Therefore, I decided to save myself from the huge infrastructural revamp, and simply left everything private.
The compiled client code is not obfuscated in any way, so you can easily check whatever you want with decompile if you want.
Over the years a lot of people used my public and private clients in Legacy Haven, Salem, and Hafen, and know full well that I never put anything malicious into my creations.