Something I hadn't considered: https://www.akamai.com/blog/security/abusing-the-service-workers-api