Holding sensitive credentials is absolutely a violation of privacy. This is like saying that having a user&#x27;s password is not a privacy violation unless you use it to gain access to their account.