Hacker News Reader

if you can query the DB directly from the frontend, what’s the security model? what prevents me from pulling sensitive data, passwords etc?

It doesn't, you still write frontend and backend separately, it just deals with the stuff in the middle for you.