I don't know of any major security holes right offhand that remain in the code; RPEDAPIReader.php is designed to allow a remote user (specifically, the RPED central server) to provide information on what rows to insert or delete from your page title table, but it won't work unless you have used the special page to generate a password and to give that password to the central server.