From meteor.com: >By default, a new Meteor app includes the autopublish and insecure packages, which together mimic the effect of each client having full read/

From meteor.com: >By default, a new Meteor app includes the autopublish and insecure packages, which together mimic the effect of each client having full read/write access to the server's database. These are useful prototyping tools, but typically not appropriate for production applications. When you're ready, just remove the packages.