Yeah, it's a proof of concept without any real security added. I do believe security is implementable. How would you use PostgRest to implement authorization in an existing system? It seems to me that we could benefit from a drop-in solution.