[alinajaf]

Yeah so, I suck profoundly at web application security, even on your everyday vanilla CRUD app. Having all of this logic available on the client needs tptacek approval before I will go anywhere near it.

Then again, I'm quite technologically conservative. I'm sure this is very exciting for early adopters but I'm not going to put any time into it until I know I can build something useful with it.

[lucisferre]

Your security should always be behind the API not in front of it and you should never rely on obscurity as a security measure.

[astrofinch]

Looks like they don't have much in the way of security yet, but they're working on it: http://meteor.com/faq/does-meteor-have-an-authentication-sys...