[threeseed]

I think it means to say that:

1) The got the code by bruteforcing the login credentials on device.

2) Server-side code is not accessible which is where the LAM runs.

[plugin-baby]

This isn’t likely though, is it? The device is unlikely to be running NodeJS and playwright.