This question doesn't make any sense. If your users can access the ip/port of your redis instance, you're already hosed regardless of whether the redis clients

This question doesn't make any sense. If your users can access the ip/port of your redis instance, you're already hosed regardless of whether the redis clients cache requests or not. The only hypothetical surface area opened up is if an attacker manages to install a virus on your server to snoop memory via sidechannels. But in this case, your data is already vulnerable using normal queries (the data must reside in memory eventually), again, regardless of whether data is being cached client side or not. Most applications most likely already cache data, at least in a variable or something for the duration of a particular function.