I purchased a very popular IM app from the Marketplace, as it was the only one that was able to connect to my company's Jabber server, and I've been using it successfully for months now. On November 30th or December 1st it stopped working, I assumed due to an issue on my company's server, since they're always tinkering with it. Late last week I started looking into it and I found out, much to my utter horror, that it wasn't my company's server that was at fault, it was the IM app's server -- I have been logging in to my company's server through their server for months now, meaning that their server had access to my password (which can be used for just about every system I use at work). I verified this by rooting my phone, installing WireShark and looking at the network traffic.
I've asked for my money back, since I paid for the app, but I really want to get the app removed from the marketplace, as it's a huge danger to anyone using it.
Please note that I have no proof that this company was harvesting anyone's password, but they could be doing it. Regardless, they're transmitting my login credentials in the clear (though they are encoding the password, which I'm sure will deter all but the most hardened hackers -- not!).