>I've never had to connect to PostGres in an adversarial environment.

heroku's postgres database service still exposes itself on the public internet.