Seems I accidently replied to a copy of this thread instead of the real thing. Here is what I said.
I don't have access to the hosting so I can't be certain but, in my view, the security of the site is appropriate for what it is. There should be no details on here about people's financials. No card numbers, no account details. No-one would think of using a banking password for logon to another site. I know Boab is currently looking for alternative hosting and that there is a newer release of XenForo to be implemented so no doubt SSL will be along soon. I wouldn't worry about your PayPal address being here just so long as you don't post the password too.