Thanks for your feedback Dargo.

To mitigate any risk users are encouraged to

• Use another email address (as Dargo mentioned).
• Make sure the API key has only one permission "Query funds", nothing else.

or

• Run their own instance after checking the code: https://github.com/trapp/krakennotifier