This loader is primarily meant for development. The default settings are not safe for production environments. See the recommended example configuration and the section on nonces for details.