[somurzakov]

you can probably hide postgREST behind combination of API Gateway/Load Balancer/WAF/IDS+IPS that could solve most of headahches with security

[FlyingSnake]

This is the correct way to go. My PostgREST is behind nginx for example.