In that case you're already running code from them so what's the difference if the "exploit" is in the script or the app.