Ask HN: How to address security incident without offending coworker?

Recently at work I had a friend use an insecure medium to send me a password to a production account. This is a big security faux paus, and means we need to rotate that password ASAP and consider the old one compromised. But this question has nothing to do with the technical side.

The friend that sent me the password was trying to be helpful, and truly I appreciated his help. If I blow the metaphorical security whistle in his face regarding this security issue, it will probably hurt his feelings and may provide a disincentive to be helpful in the future. However, I obviously want to prevent disclosures like this in the future.

How would you handle this situation?