> To my mind it can just as equally be a disadvantage - I'd usually consider the core more trusted and less exposed. If a bad actor takes a little sneak peek a

> To my mind it can just as equally be a disadvantage - I'd usually consider the core more trusted and less exposed. If a bad actor takes a little sneak peek at your database, they can brute-force hashed passwords or cookies and impersonate users. They can’t brute-force public keys. It has nothing to do with the location of data, because that is the same: user has a secret credential, server has verification function