> You have to be careful with site-to-site VPN since even your internal services like database are now globally addressable.

I’d bet that this will be the source of some gnarly leaks in future. If it does my bet would be it’s going to follow the “API keys on GH” trajectory.