[naasking]

Thanks for saying it. Client-side scripting can't protect against a compromised server when the client scripts are provided by that same server.