I found two security issues with popauth:

 -	The -trace switch lets you write the debug log to any file
        owned by user pop.

 -	The logit() function has subtle and possibly harmless buffer
	overflow because it thinks snprintf returns negative values
	when the buffer would overflow. However, it returns the number
	that would be written if the buffer were large enough. This
	makes the iLeft -= iChunk subtraction underflow, and iLeft
	will become a large positive number.

Will attach patch.