Hi StavrosK, you're right to be worried. We had someone playing with the API this week and sending wrong events. Security wasn't a primary concern for us, we started this as an internal joke (first version didn't even have a token system). Just to be clear, the light switch doesn't trigger a real light, but the way we handle sending sending the events from the browser is pretty dirty :)