Hi! Yes, security is a valid concern, no doubt. Publishing parts of code used for external communication is really of no use to you though, because you never can say if something was omitted from the list or such. So I'll describe what communication is happening.
1) The primary communication is of course between Airio and the LFS server (local or remote). Here all data flow from first establishing connection to server and then from processing all events (car positions, split/lap times, races starting, people connecting) as they are reported via InSim packets, and responding to this by sending request packets (commands, settings). This communication is necessary, it may over time represent significant data flow, and for this reason it is best to keep it local (one PC with both Airio and the LFS server).
2) If a PubStat key is provided, there'll be communication with the LFS World site. World Recodrd table will be updated every hour, which is important because many calculations depend on current WRs. Still, external WR table may be used and communicating with LFSW is not required. But if it is allowed, for each driver his online PBs (and newly also hotlaps) are downloaded and used in some parts of the application (e.g. as a time comparison base). This communication is not required, but it does not repesent large amounts of data and except your generated PubStat key no sensitive data are being sent away. In response Airio gets text/number tables with split/lap times from the LFSW site.
3) You'll be probably most concerned about the last communication type used to gather global Airio usage stats as shown on this page
and used also in !ver
output. In newer Airio versions this communication cannot be disabled. Basically, every minute Airio sends to my server data about all servers it is connected to. These are the following: Server name, track name, cars being currently used, current number of connections and drivers, basic server state (race or quali, midjoin, reset status, ...) and usernames of all currently connected people. This happens once a minute and usually less that 1 KB is sent, not a significant load. In response Airio gets total number of instance, servers, connections and drivers (cars on track).
That's it, at least what concerns the FREE version. In FULL there may be also communication with external FTP server and an IRC channel. Well, I guess it would be from your part a question of trust to believe my statement that Airio has no backdoor/hidden communication allowing me (or anyone else) to see your server password, it is never sent anywhere except when establishing initial connection to server. Really, I'd have no use for about 150 server passwords, and when that kind of cheating would be discovered it would just kill everything I'm trying to achive with this application.
If you want to make absolutely sure, I suggest you install some network sniffer and let it output everyting going externally from Airio (LFSW downloads and global stats updates) or coming back to it. Maybe you'll sleep better then.