Public Pages Should Not Read Raw Database Records

A database record often contains more than a public page needs. It may combine public identity with internal state, access relationships, operational fields or values added for trusted workflows.

Sending that complete record to a browser and hiding fields in the interface is not a public-data strategy. The browser has already received them.

Design the public read deliberately

A public route should request a bounded read model containing the fields that surface is allowed to explain. The server resolves the canonical record, applies policy and returns a deliberate representation.

This boundary is sometimes called a projection. The important point is not the name; it is that public data is selected before it crosses the trusted boundary.

Keep identity unambiguous

Public projections should not create a second identity system. A route family needs one declared route key and a clear way to resolve it. Presentation may fall back between labels, but display fallback should never decide storage identity.

That prevents subtle failures such as linking by an internal ID in one place and a mutable slug in another, or querying both and accepting whichever happens to return first.

Avoid duplicate truth

A projection is a read boundary, not permission to maintain an unrelated copy of the Entity. Canonical identity and lifecycle remain with the owning domain. The public model selects safe fields and may derive presentation facts, but it should not acquire independent update authority.

Useful checks include:

• Can every returned field be justified by the public page?
• Are private relationships physically owned elsewhere?
• Is the route key declared once?
• Does a missing record produce a truthful status?
• Can the public API evolve without exposing the canonical storage shape?

What we do at FireUX

FireUX public entity pages use bounded server readers and named read models where the public surface differs from canonical storage. Browser routes do not receive raw database authority. Entity domains retain their identity, policy and actions, while public endpoints own the transport boundary.

This makes privacy reviews concrete: we review the fields that cross the boundary rather than trusting every consumer to remember which properties not to render.

The same ownership principle appears in thin Nuxt pages and domain-owned product logic.