I see the ambiguity now, but I meant if they remove the evidence before making it public. Sure, if the code itself spans the client/server boundary, it's easy t

I see the ambiguity now, but I meant if they remove the evidence before making it public. Sure, if the code itself spans the client/server boundary, it's easy to find it, but it doesn't really work if they're just using a library on the backend that isn't exposed directly to the user.