Probably not. All side effects need to go through the js side. So you can alway see where http calls are made

> Probably not. All side effects need to go through the js side. So you can alway see where http calls are made

That can be circumnavigated by bundling the conversations into one POST to an API endpoint, along with a few hundred calls to several dummy endpoints to muddy the waters. Bonus points if you can make it look like an normal-passing update script.

It'll still show up in the end, but at this point your main goal is to delay the discovery as much as you can.