> An attacker has to know about a vulnerability to use it.

The hacker does, GPZ does not need to know.