Web Truths: JavaScript can’t be trusted