I recently started using bootstrap SCSS on my node project. So I have app/bower_components/bootstrap-sass/lib/_glyphicons.scss for example.
app/bower_components/bootstrap-sass/lib/_glyphicons.scss
Looking at my CS
Here is the variables file where they set the $icon-font-path variable.
$icon-font-path
It looks like $icon-font-path is set to the foldername of the font files. not necessarily a security hole because its a relative path to the fonts.