At that point, yes, it's too late. The issue here is that their developer console is also the chat and that users can receive external messages from anyone in t

At that point, yes, it's too late. The issue here is that their developer console is also the chat and that users can receive external messages from anyone in that "console". If you want to have the chat be the console, you really need to make sure everything is safe.