Do you run runscope forever? Or is it disconnected after your debugging is done? I'm just wondering about the security aspects of this. As I see it, someone gaining access to your runscope account can effectively re-use access tokens and read personal information on the log files. So, does runscope delete data on request?
Some of our customers are running it in production apps but for the most part you turn it on to solve a problem then turn it off when you're done. Down the road we'll be making production use more useful with the security concerns you mention at the forefront.