I noticed that the javascript generated by the JSAPI widget includes all the
layer information from my map file including connection parameters for Postgis
layers which includes the user name and password!

According to Paul Spencer this can be fixed by editing:

chameleon/htdocs/widgets/cwcjsapi/cwcjsapi.widget.php

and removing line 208 which reads:

$szLayerInfo .="aLayerconnection[".$i."] = '" .  $poLayer->connection .
"';\n";