my regular example is a box with something like myrole=blabla_dev as fact and the attacker just changes it to myrole=blabla or myrole=blabla_prod to eventually get a production catalog with production secrets