You might have Nova open in one tab and an unknown site in another, both running JavaScript in the same browser. A few strict rules stop the unknown site from reading your messages, and one more rule keeps cheaters off the leaderboard.