One of the most basic security principles is literally “never trust the client side.”