it this exact flavor of bullshit that i worry about whenever someone tries to convince me that keeping a password vault in the cloud is ok.
how soon does your vendor patch?
do they even know?
will they even patch? do they care?
because you have given that control surface to them, and they have protected themselves from you by way of using contract language
