Don't confuse PostgREST with something that you just point at a (poorly designed) database schema and magic happens and you get a nice api. You point it to a s

Don't confuse PostgREST with something that you just point at a (poorly designed) database schema and magic happens and you get a nice api. You point it to a schema that consist only of views (that you define) and stored procedures (that you write) that abstract away the underlying tables. You define constraints on all your columns so junk does not get into the db. You define database roles and RLS policies and give them privileges so that you control who has access to what. You still in a way write backend code, but in this case backend code is mostly views/constraints/triggers and in rare cases stored procedures.