Admittedly, we aren't stopping this at the moment, but it's something we should add in the future - validating the origin of the websocket against a list of installed/permitted apps.