XEP-0030 Service Discovery (section 8) contains a few security considerations that Openfire must implement. These apply mostly to scenario’s where requests are sent to bare JIDs of entities that do not exist, or to which the requester has no subscription.

Note that the XEP-0030 definition of how to handle a ‘user does not exist’ scenario in context of disco#items processing seems to contradict RFC 6121 8.5.1. "No Such User" (as implemented via OF-880). For disco#items handling, Openfire should follow the XEP, not the RFC, as the XEP is more specific standard of the affected functionality.