What could possibly go wrong using an open source project for authentication against your bank accounts? Where have we seen this before?

You best audit the shit out of that code if you actually use it. Every. time. they. update.