> I wanted to say something so badly. "Hey, you might want server-side validation too." But this was a proof of concept, not a consultation.

oh man, imagine telling them "you don't want people like me breaking into your app! Just look at how I got into this call!"