Actually, another concern I'm thinking through that is maybe more urgent It looks like the production token is viewable in the manifest.. Does this mean anybody can override anything if they can see the manifest ?