Summary The bytes a client sends as a V2 binary user broadcast are spliced verbatim into the JSON text frame that other clients receive, without ever being parsed or validated. Any client that may broadcast on a channel can therefore write arbitrary top-level Realtime protocol fields into the frames every other subscriber on that channel receives, including a forged postgres changes database-change event and a forged phx close . On a public channel no authorization of any kind is involved: the anon key is published in every client bundle by design, and public channels run with policies: nil .