Password-stealing “vulnerability” reported in KeePass – bug or feature?