Super insecure?

[zmarffy]

https://github.com/wix/corvid-examples/blob/b084d50a563eb10b4d1a8cbd362cc072d3b648ea/wishlist/src/page1-code.js#L36

Isn't this like super insecure because if you do one of these DB queries in the frontend, anyone can do so for any user ID via their browser's dev tools?

[Salman2301]

You can control the queries using a database setting. So, only the signed-in user can have access to their data or perform the CRUD
Wix check the permission by default, so you no need to check for the permission with a separate server function and that's why we can directly communicate with the database from the front-end securly

You can read more here
https://support.wix.com/en/article/changing-your-database-collection-permissions