Drupal security measures
Ask for the actual security report.  They often contain explanations about what the problem really is, as well as offering a solution.

I believe this will take care of the password autocomplete issue; I have a client who requires this and have it deployed on a few sites.

function mymodule_form_alter (&amp;$form, &amp;$form_state, $form_id)
{
  // http://www.midwesternmac.com/blogs/jeff-geerling/disabling-autocomplete-forms

  if ($form['#id'] == 'user-login') {
    $form['#attributes']['autocomplete'] = 'off';
  }
}