I think this is actually a great idea, and not just a vector for attack as some are seeing it. I'm undergoing an intense security review process right now whil

I think this is actually a great idea, and not just a vector for attack as some are seeing it. I'm undergoing an intense security review process right now while designing a new service. A broad stroke definition of the process might be "apply best-practices" which are sourced from domain experts, manifest as checklists (do you do XYZ?) which lead to heaps of documentation, as well as weekly consultations with a security pro assigned to our team. We're very very lucky to have very deep pockets and decades of experience to draw from. Most won't. In fact.. so many things I am working on are to go above and beyond to protect our customers, who configure their application in insecure ways and then blame us..