what does rotation mean? you can change your passwords, both the "master" which i rather call input, and the output password as well. i mean you can have a new output password without changing your input password.
and no although i can only guess what you mean with vaultfile, an attacker still needs access to the sphinx server, which has protections against bruteforce attacks.
