Hacker News Reader

Is there any way to disable this scripting API? It seems like an enormous security hole.

This has been considered. See here for details:

I don't think it's on by default: I got an alert to enable it and then another warning when trying to load my own script.