[zemnmez]

if you can query the DB directly from the frontend, what’s the security model? what prevents me from pulling sensitive data, passwords etc?

[andkenneth]

It doesn't, you still write frontend and backend separately, it just deals with the stuff in the middle for you.