[rasguanabana]

That’s why you need more than one layer of security over your critical assets. Network based access control to me always feels easy to misconfigure. Basic auth would delay attacker. Encryption of data at rest would render stolen data unusable to attacker.

General advice - perform threat modeling of your services to uncover weak links.