It happen with all 3D object generators.
Could be a problem ONLY if you share the .sh3d file.
In such a case you could edit Home.xml to remove creator fields.
Sharing the objects or a library will don't have such information.

I know I can edit the Home.xml file to remove the references but that is not the way it should be. It's a plain security leak.

Is this caused by the SH3D exporter or a Java function? If it's in the SH3D exporter Emmanuel should be able to fix this for all generators. Even replacing the creator tag with 'default' is better than the real user name.