Security is done via row level access control, a system that is vastly better then the ad-hoc systems people reinvent outside the database for every application.
You also absolutely take the time to think through what should and should not be exposed to end users. Either you creates a namespace for your API with views that expose only the necessary data, or with something like Postgraphile you can specify which functionality, columns, and tables are hidden. Personally I prefer the view approach as it decouples your API from the database implementation.
You also absolutely take the time to think through what should and should not be exposed to end users. Either you creates a namespace for your API with views that expose only the necessary data, or with something like Postgraphile you can specify which functionality, columns, and tables are hidden. Personally I prefer the view approach as it decouples your API from the database implementation.