title: AngularJS: Is Batarang a security hole?
body: <p>I've been using AngualrJS and Batarang (the chrome plugin for inspecting $scope variables). And I noticed that you can actually inspect the scope even in production.</p>
  
  <p>Let's say there is a site with a page that has a scope variable <code>$scope.permitted = false</code> and in the view there is `ng-show="permitted" that hides a div full of top secret info. Couldn't I theoretically just go into the console and run:</p>
  
  <p><code>&gt; $scope.permitted = true; $scope.$apply();</code></p>
  
  <p>And then see the top secret info?? Isn't this a huge security hole for all angular apps? So angular shouldn't be used to show anything sensitive?</p>