google chrome - Meteor Dev Tools Auditor is marking collections as insecure -

i use meteor dev tools plugin in chrome, , i’ve noticed cool new feature, worrying me way i've coded app. audit collection tool telling me of collections insecure.

i still using meteor 1.2 blaze

1. 1 of them meteor_autoupdate_clientversions

1.1. should worry one?

1.2. how protect it? insert, update , remove marked insecure.

2. have cycles collection, has marked insecure: update , remove collection updated on database , not supposed accessed frontend, , not meant related client interaction.

for collection have these allow/deny rules in common folder (both client , server) i've tried applying these rules on server side, didn't see difference on audit results.

2.1. should these rules on server side?

cycles.allow({     insert: function () {         return false;     },     remove: function () {         return false;     },     update: function () {         return false;     } }); cycles.deny({     insert: function () {         return true;     },     remove: function () {         return true;     },     update: function () {         return true;     } }); 

2.2. how protect collection?

3. , then, have collection insecure check users, remove marked insecure. on webapp don't make use of users, there no login, etc. might want implement in future, though.

3.1 should worry collection being insecure, since don't use @ all?

3.2 how protect collection?

you not have allow or deny. remove insecure package meteor app. can use publish/subscribe , methods data insert, update , delete.

remove please fo code app:

cycles.allow({     insert: function () {         return false;     },     remove: function () {         return false;     },     update: function () {         return false;     } }); cycles.deny({     insert: function () {         return true;     },     remove: function () {         return true;     },     update: function () {         return true;     } }); 

for 1.1

this happens while user logging. basically, issue not login method. see wait time: https://ui.kadira.io/pt/2fbbd026-6302-4a12-add4-355c0480f81d

why login method slow?

this happens when everytime, app gets reconnected. so, after sucessful login, re-run publications again. that's why saw such delay login hence publication.

there no such remedy , kind fine unless app having lot of througput/subrate method/publication.

for 3.1 : not have worry inscure anymore after removing allow/deny , insecure package. make sure, write secure methods.