I'm not the OP, but I did write the article. I'm probably going to write a follow up addressing getting started with security. Meteor's security is pretty good now, but it was a little too verbose for a short demo. Basically, on the server side, you publish exactly the set of documents a specific client/user will receive. You can also whitelist/blacklist specific behaviors with allow/deny.