The JavaScript served from this page is part of the trust boundary: anyone who controls the code served here can read your message.