@lina That's pretty much broken by design.

They say: We need to assure that client devices are trustworthy enough to run our code.

I say: No way, stupid. Always assume that your bloated code runs in an untrusted environment and design it accordingly. And get your hands off my client browser. My device - my rules.