As a fellow web developer I wanted to poke around the clientside code to see what it might tell me. After looking at Firebase I found that anyone with knowledge of how your game is stored will be able to edit, modify, and even delete your campaign. The worst part is the fact that you don't even have to be apart of the game to do this!
Look at the source of the page:
Find the variable: campaign_storage_path , whatever this is, this will be added to create a url that will look something like this: <a href="http://gamma.firebase.com/roll20/campaign-123-IchangedThisPath" rel="nofollow">http://gamma.firebase.com/roll20/campaign-123-IchangedThisPath</a>
Then you will get an interface from which you can edit, delete, and even add data without talking to roll20.net
Even if the edit page was removed from public access (hopefully you can whitelist IPs or something) anyone with a little javascript knowledge can use the above information to create their own program locally, live editing the browser, or faking requests to Firebase to wreck someone else's campaign.
HOWEVER this has an upside because this means that programmers like me can hook into Firebase to modify the contents like an API, kinda sorta like I was asking for at
<a href="http://community.roll20.net/discussion/358/api-structure-suggestions" rel="nofollow">http://community.roll20.net/discussion/358/api-structure-suggestions</a>
