This was actually a feature requested by me. We have the requirement that our desktop and mobile clients have to react differently depending on the enabled apps. This is a password protected feature which is only available to users with accounts who can see the apps in the web-interface anyways. So I'm not sure the risk is high here. @LukasReschke What do you think?