“"You can use the database api on the client!" Does that freak anyone else out? Where are they doing permissions checking? Who can run what database commands under what circumstances?”