@FinchHaven I guess in theory someone might be able to write something that would draft a post and trigger the publish button, maybe even multiple times. I think that would show up to an instance admin as abnormal posting behaviour of lots of posts were made in quick succession. Javascript is a key part of most browsers, so it would be hard for anyone to disable, but the API method that opens the composer window could be disabled if people started abusing the technology in that way.