What has to leave the browser, and where to put it
As long as an app runs entirely in the browser, nothing stops a user from reading or changing what it contains. This lesson helps you decide which functions must move to the server, and choose a back-end platform such as Supabase or Firebase that fits your app, your budget and your data.
Lesson objective
By the end of this lesson, you will be able to sort your app's functions between browser and server using the trust boundary, and to choose a back-end platform (Supabase, Firebase, or server functions with a separate database) that fits your app, your budget and your data.
Topics covered
- back-end architecture
- trust boundary
- Supabase
- Firebase
- server functions
Where it fits
Decide on the architecture and protect your secrets
What has to leave the browser, on which platform, and where does each key belong?
Lessons in this module
- What has to leave the browser, and where to put it (this lesson)
- Environment variables and secrets, without leaks
What you will learn in this module
This lesson is part of the course Add a database, authentication and payments to your app
- Decide what stays in the browser and what must move to the server, and choose a back-end platform that fits your app, your budget and your data.
- Manage environment variables and secrets (public VITE_ variables, secret keys on the server only, .env files kept out of Git, rotation after a leak).
Related courses
- AI & DevelopmentJuniorSome basics are useful: introductory knowledge of the topic.
Build and ship a web app with an AI coding agent
2 hr 45 min
- AI & DevelopmentAdvancedRegular practice: you already use the tools or work on this topic.
Work with Claude Code on a real project: context, planning, review
3 hr
- Product ManagementAdvancedRegular practice: you already use the tools or work on this topic.
Git for PMs: ship as a team without putting production at risk
3 hr 30 min