So replying once in the negative reveals negligable information and probably does not risk identifying the vendor at all.