@cliffle In order to be vulnerable it has to have some interface surface with malicious data, which usually means it's not entirely internal. In some rare cases, this does happen where the interface surface is just race conditions or something that can be exploited without an explicit interface surface. But usually it means we're in the case where it's between the extremes of purly internal and external interface surface.