Don't claim a security boundary holds — demonstrate it

· Dev.to