Alas there is at least one bad bug in this tool, specific to eDirectory that has two affects.
If you edit an object and add an attribute, it may re-write the values in sasLoginConfigurationKey (actually all the sasLoginConfiguration* attributes) which contain the challenge/response questions, Secret Store data, and Simple Password. This WILL corrupt them.
This will manifest with strange errors trying to use any of this encrypted data. I forget the error code we saw in User App, but I think it might have been a 618 DS error on the attributes when you try to read or set the Challenge Response questions.
It also looks like the DirXML-EntitlementRef if present will experience a similar process, in that it will rewrite them, and thus fire your Entitlements processing rules., which is not as bad as the corruption, but annoying.