When this matters
Backend work matters as soon as your app has real users, protected data, private API keys, or actions that should not trust the browser. Contact forms, payments, dashboards, login flows, and webhooks all push you into backend territory fast.
Small example
Charging a credit card belongs on the backend because the secret API key and the final amount should be controlled server-side, not trusted from the browser.
Frontend: collect form data and send it to /api/checkout
Backend: validate the order, call Stripe, return success or failureCommon mistake or lookout
Assuming a frontend framework automatically makes security decisions for you. If sensitive logic runs in the browser, users can inspect it, bypass it, or call your APIs directly.
Why this matters for vibe coders
Vibe coders can get surprisingly far with polished frontends, then hit a wall when they need sessions, server validation, or anything secret. Knowing what belongs on the backend keeps you from forcing the browser to do work it should never be trusted with.
Where this shows up on the site
Job guide
Add a Database
When your app needs to save stuff, you'll need one of these...
Job guide
Add Authentication
You need logins, sessions, and account recovery without accidentally turning your weekend into a security incident.
Tool review
Cloudflare Turnstile
Cloudflare’s CAPTCHA replacement for lightweight human verification on forms, signups, and other abuse-prone flows. A low-friction way to make cheap bot abuse harder without making real users solve puzzle garbage all day.
Tool review
Firebase
Google’s app development platform for building, shipping, and monitoring web and mobile apps. Batteries-included backend services: databases, auth, hosting, storage, functions, analytics, crash reporting, and more.
Comparison
Supabase vs Firebase for Vibe Coders
These are two of the fastest ways to bolt a real backend onto an AI-built app, but they optimize for different futures. Supabase is usually the better default for SQL-first web apps. Firebase is still brutally effective when speed, mobile support, and Google-flavored app tooling matter most.
Blog post
Supabase, Mattsplained
Read the full post.