BuddyPress.org

Also, to answer your question:

How would you do the security check?

These must be done server side. You’re right to think that anything done via the client can be tainted (manipulated by an end user).

The general process is:

• Make an AJAX call passing any client-side data to the server
• Process the data (secure it and perform necessary privacy checks) and then send a response
• Do something client-side with that response

For more info on AJAX and WordPress, check out the AJAX in Plugins article.