A library might, for example, inadvertently log errors containing sensitive data, send unencrypted http requests containing sensitive data or include WebViews with vulnerabilities.
For projects that include sensitive data, if you are using a 3rd Party library as a .jar file then include the source code instead so that you get the lint warnings and can also examine the code for vulnerabilities.
