A few things:

* I have to trust thimbl.net and/or you that you aren't storing anything.

* Even if you released your codebase on github (or similar) there is no guarantee (to outside users) that it is the same one that you are running on your servers.

* Your site is not https, meaning that my ssh password is going plain-text over the internet.

* Even if your site is 100% not doing anything funny, there is the possibility for someone else to sniff the passwords flowing through your site.