The fact that there is an app that downloads privileged code as a normal course of action is already a Remote Code Execution issue to me. Furthermore, the fact

The fact that there is an app that downloads privileged code as a normal course of action is already a Remote Code Execution issue to me. Furthermore, the fact that it's only https protected means that any https proxy in between me and the server (say a corporate firewall) can execute random code on my computer. No thanks! And they are just a single hack of their static js hosting away from having all of their active user's computers hacked.