Everything could be a risk, but in the specific case of a software device holding data, I believe that the main problem is the exposure of the data itself, so i

Everything could be a risk, but in the specific case of a software device holding data, I believe that the main problem is the exposure of the data itself, so in the specific case of Redis the fact that the database stores informations about which key was retrieved by which client should not be an issue AFAIK. A few random arguments: 1. The database anyway sees such connections and there is a continue stream of activity about clients, so there is also an instantaneous state that discloses who does what, at any time. 2. Companies trace everything in order to have data to do debugging when there are problems, so this information is stored at a much better level of details in other places as well. 3. There is no obvious way this could be exploited. 4. In general it is supposed that the clients can trust the server. 5. If you already violated Redis in order to read such info (not accessible via APIs), you can collect a lot more. So based on initial thoughts I don't think this is going to be ever a security problem.