Looks like Matrix just got educated on hiding administrative stuff behind a VPN, by the guy (or gal, but those don't exist on the internet) that hacked their production infrastructure. Coincidentally, it reminded me of that time when a dev wanted to educate me, a sysadmin, about VPN's 😄
https://devrant.com/rants/2030041

What I've learned from this incident are 2 things.. well mainly 2 things.

1. Never *ever* entrust developers with production access. Let DevOps take care of the glue that sticks dev and prod together.
2. Trust nobody's competence but your own. Matrix was advertised as "highly secure", and then they do a fuckup like this. Only trust yourself, and ensure that you're in control.