Yeah, I suppose it's possible. I could guard all API calls with a check for table ownership. It's probably a good thing to do, but I'm really feeling the heat of time. I'll make an issue for this and come back to it. Maybe an EQC test is in order :-)