How is security handled here when it seems like the client can write freely to the database? Are there any restrictions?