It’s completely bypassable client side fwiw last I checked