Thank you. Just working through a checklist of vulnerabilities, I appreciate the answer.
Out of curiosity, is it possible that if I have an organizational ID for a business, I could write something to pull data out of someones SalesForce account? Or does that app have to be registered with SF and the organization to be able to access their DB?