Comment 6 for bug 858867

Given James' and Daviey's comments above, I think we should just let this be.
Its more likely that sensitive information would live in the kickstart files (url=) which are not protected at all either.

Is there some appropriate way to document this and close it as such?