DB queries are validated through a whitelist on the server, so it should be impossible to run an unauthorized query when it's locked down. E.g. https://github.com/mikemintz/react-rethinkdb/blob/master/exa...