find the current App user from a script/flow

If I'm running a flow that is executed from an app.

WM_EMAIL

WM_EMAIL

is the email from the user that has deployed the app. Is it possible to get the current user?
I know i can get the current user by sending the

ctx.email

ctx.email

but how do I ensure that a user do not modify this, or just call the api directly with another value? Is this handled with regards to security ?