I didn't explain possible attack vectors because it depends what the vulnerable code exploit does.. does it dump ENVs, and you have a secret there? Does it leak DB credentials? If it's infrastructure code, does it tell someone what IP addresses can attempt SSH?

I hoped by saying "a layer of defense" indicated that there was more layers