@chris.raroque: by far the biggest misconception though… Is that people assume their app code is private 😬 You basically have to assume that anybody can take your app, decompile it, and view the code Same goes with web apps. If you store any environment variables or credentials, it's pretty easy for someone to find them If you make any calls directly from the front end, you also have to assume someone can find those and deconstruct them The number one mistake I'm seeing is people making API calls from the front end and passing in sensitive environment variables in there. Like API keys for AI providers, for example 🙅‍♂️ This is also a big reason why people have a problem with providers like Supabase and Firebase. They make extremely sensitive calls from the front end directly to the database and the only protection layer is real level security or Firebase security rules One slight misconfiguration could leave you completely exposed and anybody who figures out your endpoints can start manipulating and viewing sensitive data The best thing you can do is to move all sensitive calls and ideally even all database reads to a backend service that they can't snoop around #softwaredeveloper #coding #appdesign

Chris Raroque

Open In TikTok:

Region: US

Friday 06 March 2026 19:49:07 GMT