thats nifty, so can attackers upload the user's codebase to the internet as a package?