javascript security nerf