1/ The fact that CRM variables are deployable from sandbox to production goes against the principle of environment separation. We are at risk of overwriting production with sandbox values; or vice versa when rebuilding the sandbox as production vars will leak into sandbox! It should not be possible to overwrite either way or at least not as easily as it is now!

2/ The other significant risk is that reading variables in client script requires "Manage Zoho CRM Variables" permission which we are therefore forced to grant to all non-dev users who need to use such client script! Without the permission, `ZDK.Apps.CRM.Settings.fetchVariables` fails.