JavaScript itself does not make an application more or less secure. It’s what you put in the JavaScript that matters.

The rule is simple: don’t put secrets or sensitive logic in your JavaScript.

BreezeJS does nothing to compromise this rule. It describes the data that you have decided to present to the user: their data properties, their data types, their relationships to other data, and simple validation rules (e.g., required and max length). Where is the risk in that?

Breeze makes it easy for you to query and save those data. Easy is good. Doing it the hard way, perhaps with raw AJAX, doesn’t make it more secure. It just makes it harder.

Suppose you have a type “Foo” with a “companySecret” property. The risk isn’t knowing that “companySecret” is a required string with a max length of 30 characters. The risk is that you send the company secret itself.

Is the data too sensitive? Don’t let your server send it! Is the user not authorized to see it? Don’t let your server send it! Does your app perform some secret, proprietary business processing? Do that on the server, not in your client-side JavaScript. The situation calls for prudence on YOUR part.

Breeze … and Knockout and Sammy and Durandal … the key components of HotTowel … are infrastructure libraries to help you build the best user experience possible. They are tools. Use them wisely.

Thanks.