Thanks for posting that very important point about the Coder module. We were mitigated by the fact we used Composer to install an internal distribution and Code

Thanks for posting that very important point about the Coder module. We were mitigated by the fact we used Composer to install an internal distribution and Coder was in our /vendor/drupal/coder directory, not inside docroot.