- make sure all our backend endpoints are gated by authentication - also socket.io all messages coming in should be gated as well