Well at runtime one would hope they're not giving their JS app access to their home folder.