If I have my metabase installation protected behind oauth with G suite am I protected from these kinds of vectors?