@philip @synec oh no! this was not in the threat model