have they sorted out the security issues with having the sync code exposed to clients? what prevents others from accessing that information when they shouldn't?