This program requires complete access to your wallet.
If the "flaw" requires full control of the wallet, then wtf is the point?
It doesn't mean that it has to be sender's wallet. Any wallet will suffice. It seems that the program is using RPC API to get info about transactions.