Well not really, anyone could type in 'io.call()' and it would add a new player to your server with no controller. 'while(true) { io.call() }' would kill your server in about a minute