Wouldn't the actual business logic remain behind an authenticated API endpoint? Even your relational data models would probably be turned into something more li

Wouldn't the actual business logic remain behind an authenticated API endpoint? Even your relational data models would probably be turned into something more like a tree. Only if you're going full REST will there be a risk of client-side business logic.