Simple one thumb rule. - just don't let "plain" raw js execute over ur client. :|