Hacker News Reader

you can probably hide postgREST behind combination of API Gateway/Load Balancer/WAF/IDS+IPS that could solve most of headahches with security

This is the correct way to go. My PostgREST is behind nginx for example.