10. Keep the production boundary honest
generated Luau client · trusted JavaScript handler · about 25 minuteslocal backend support is not hosted deployment
The recipe proves local development behavior, not production infrastructure, secrets, or service availability.
When to use it
Read this before adding authentication, database access, provider credentials, or publishing a server-backed application.
- Client Luau and generated client code are public application artifacts. Never place a secret in either one.
- Public operations still require validation, rate limits, abuse controls, and safe error messages in production.
- Use user or admin authorization for protected work and enforce ownership inside the handler.
- Retries are safe for this read-only query. Mutations need an intentional idempotency policy and stable key.
- The candidate includes a local backend for luastra run; production backend deployment is a separate host decision.