Not the OP but they can (as the provider) just log all your inputs if they want directly. No code word or vulnerability needed.