The data store on the client side isn't the whole data store, it's the things you've published and subscribed to, which can change easily based on authenticatio

The data store on the client side isn't the whole data store, it's the things you've published and subscribed to, which can change easily based on authentication, your userId, or however else you program it. Meteor has an "insecure" mode that is active by default where everything is published. Don't use that in production.