Why should the Hacked! module not be used on a production server? In the source code of the Hacked! module, it says it should never be used on a production server.  

/**
 * @file
 * The Hacked! module, shows which project have been changed since download.
 *
 * We download the original project file, and hash all the files contained
 * within, then we hash our local copies and compare.
 * This module should never be used on a production server.
 */


Why not?  How would it compromise security?
A quote from the developer of the module, in response to exactly the same question:


  The module is aimed at developers wanting to know what other developers got up to, not to detect if someone broke into your webserver and changed some code.


As such it doesn't really belong on a production server; it doesn't appear to be a security risk (although it does download to your local files folder), it's just not what the module was designed for. 

There's also another comment on that post that sums it up nicely:


  It's not that it's fragile, unstable or (very) dangerous.
  It's just that "You're doing it wrong" if a production site is where you actively use the features provided by "hacked".