An axiom of secure programming is to never trust the client. You don't really know what the client is. Often it takes several penetrations via compromised/repl

An axiom of secure programming is to never trust the client. You don't really know what the client is. Often it takes several penetrations via compromised/replaced clients to get the message through. Just look at all the discussions about why browser-based javascript encryption is problematic.