I'm still surprised by the number of web developers who do not understand that, once you include someone else's Javascript on your site, they have full access to everything on your site, including all submitted customer data.