The SQL code is kept on the server machine and never sent to the surfer. That means a surfer cannot save your web page, change a few keywords, and break into your database. For highest performance and highest security, HREF recommends putting the database on a separate machine and connecting to it using a second network card which is not open to the Internet, just to the web server machine. WebHub comments are stripped out before the HTML goes to the surfer, so your ideas and notes are completely private. Even if you don't use any WebHub comments, a surfer will not be able to figure out what you did with WebHub macros by viewing your web pages.
Surfers can see only the result of all the processing, never the code that caused it.
The same thing goes for changes in browser type. While it is legitimate to change browsers during testing, it is quite rare for a real surfer to do this, and a programmer can decide to use this event as a security-risk flag. Surfers are then required to login before using certain pages, or even parts of pages, within your site. You can set up a security system based on any number of levels of access. Let's say the threshhold is 30 minutes.