Thinking about security is good! AJASON only allows to call functions and methods which have been explicitly registered before! But please bear in mind that AJASON does not enforce access privileges of any kind! Every registered function/method can be called by anybody!! Even trying to hide JavaScript AJASON calls for unprivileged users is no good and secure solution at all. Your server side PHP functions/methods must always enforce the rules if required - for example by validating users through a session management.