Client-side security IRL