How about client seeds being leaked? a web html page need just some scripts to do so

 As OP said, when the "server secret seed" can be "manipulated" as much as wanted,  that's don't give any real insurance there