(can't reply directly due to nesting limitations)
Because we're so heavily client-side, we created a policy-based security api to allow you to control the actions allowed using the filepicker.js library, as well as actions in your developer portal that you can use to make things read-only, set the max allowed file size, etc.