I’ve been playing with some of the new "vibe coding" tools recently. While they’re great for speed, I’m seeing a lot of generated code that basically leaks API keys or sensitive logic into the frontend because it’s easier to build that way.
Coming from a database background (we worked on Chat2DB), we decided to try something different with our new project, zoer.ai.Instead of the usual "frontend-first" approach, we’re forcing a Database-First architecture.
The idea is to provision an isolated, secure backend for every app so that secrets and business logic stay on the server side, not in the browser.
Curious to hear the community's thoughts: Is it overkill to build a dedicated backend for a simple AI-generated MVP, or is the current BaaS-centric model a security nightmare waiting to happen?
Recommended Answers
Jump to Post— jkon 738Curious to hear the community's thoughts
Don't advertise like that , it makes you spammer and it hurts your SEO and the perception about zoer.ai for everyone reading this (except you are a competitor and you really want to do that)
All 4 Replies
I don’t think it’s overkill at all. Putting secrets in the client for the sake of speed is just technical debt with a countdown timer. BaaS is fine for prototyping, but once real data or paid APIs are involved, a thin server-side layer to own auth, rate limits, and secrets feels like the minimum—not an enterprise luxury.
Curious to hear the community's thoughts
Don't advertise like that , it makes you spammer and it hurts your SEO and the perception about zoer.ai for everyone reading this (except you are a competitor and you really want to do that)
What you need to know. THERE ARE NO SECRETS IF YOU USE THE CURRENT A.I. SYSTEMS THAT YOU DON'T HOST.
Techbro's have sold out. All it takes is an ADMINISTRATIVE WARRANT and the US REGIME gains access.
No reason to not tell everyone what is going on!
I do not think it is overkill at all. The “vibe coding” speed is nice, but pushing secrets and core logic toward the frontend or loosely secured BaaS layers is already causing real problems.
For very quick demos, BaaS can be fine, but once an MVP touches real data, paid APIs, or users, the security trade-offs get risky fast. Leaked keys exposed business rules and hard-to-audit logic are common outcomes.
A database-first or backend-first approach makes sense, especially if you can standardize the backend setup. It keeps trust boundaries clear and gives you room to evolve without rewriting everything later. The real challenge is making that backend lightweight enough that it doesn’t kill iteration speed—but conceptually, the direction feels right.
We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.