In the Reference section of the manual, I recommend adding a warning at the place where it describes imap_pass and pop_pass:
mutt's bug reporting program will send the user's .muttrc file to everyone on the development list, so imap_pass and pop_pass should really be put in a separate file sourced from .muttrc. The user should be aware of this.
