In infosec keychains are about  as sensitive as private as it gets. They should probably change it to &quot;do not pull or retain any data from any server except that which is explicitly needed to identify the vulnerability&quot; for those who might not understand.