That's right. In addition, Facebook has an 'appsecret_proof' method where you can require signing of all API calls with the app secret. We've now implemented th

That's right. In addition, Facebook has an 'appsecret_proof' method where you can require signing of all API calls with the app secret. We've now implemented this. Details: https://developers.facebook.com/docs/reference/api/securing-graph-api/#appsecret_proof https://developers.facebook.com/docs/reference/api/securing-... Thanks for the kind words :)