Data security in webR apps

Hi,

I'm curious about a particular aspect of the webR submission package. How do you minimise potential data breaches? I thought you might use or propose APIs like GraphQL, for example, for secure data. However, from my understanding, that would require the webR app to store credentials, which cannot be secure. Will the eventual adoption of JSON from XPT help facilitate this more effectively?