Yes, hence the need also to proxy.

With both you can keep an eye out for any unusual looking identifiers being passed around, tie that back to the code and if not, ask questions in public.