The backend your AI can't misconfigure.
Coding agents ship fast and get access rules wrong. On Bazaar there's no shared table to leave open: each user's data sits in their own database, private until they share it. A generated bug reaches one user's data, not everyone's.
Works with Claude Code, Cursor and any agent that writes JavaScript SHARED TABLE Every user exposed
allow read: if true BAZAAR One user, at most
no rules file When the AI writes the backend, three things break.
Rules missing or wide openRow-level security left off, a test rule never removed. The app
works, so nobody looks.On Bazaar: there's no rules language. Data is private until shared.
A secret key in the bundleThe admin key ends up in the browser code, and anyone can read
everything with it.On Bazaar: a static site has no secrets. The app id is public by
design.
Too much code to reviewServer routes, migrations, policies. You don't know what you don't
know.On Bazaar: one small SDK. Sharing is one readable call.
You can read what your agent shared.
Every grant is one call with four fields: what, to whom, which access, which documents. Ask your agent to list them, and check each one like a sentence.
// "Sam can read my packing list." await bzr.permissions.create({ collectionName: "packing", granteeType: GranteeType.USER, granteeId: samId, types: [PermissionType.READ], })
Paste this before you describe your app.
Agent docs (llms.txt), templates and an MCP server: coming soonBuild this as a static site (Vite + [React|Vue|plain JS]).
Use Bazaar (npm: @bzr/bazaar) for login, data, files and sharing.
- Do not add a server, an API route or another database.
- Store each kind of thing in its own collection. It lands in the signed-in user's own database.
- Share only with bzr.permissions.create or share links, never with "anyone" unless I ask.
- After each change, list every permission you created and who it reaches.
Docs: https://www.bzr.dev/docs Safer by default isn't safe by magic.
Check the grantsAn "anyone can read" grant on a private collection is still a leak.
Bazaar limits the blast radius; it can't read your intent.
The frontend can still send data outApp code runs with the user's sign-in. If your agent adds analytics
or a fetch to another service, data goes there.
Name Bazaar in the promptModels know Firebase and Supabase better and will reach for them.
App builders like Lovable, Bolt or v0 bundle their own backend.
No server codeIf your idea needs cron, push or webhooks, Bazaar isn't the right
backend for it.
AI features with no API bill. Your users bring their own key.
A static site can't hold your API key, and inference costs grow with users. So let each user add their own key: it's stored in their database, and their browser calls the provider they picked.
Template: coming soon 1User pastes their provider key once. It goes into a collection in
their own database, readable only by them.
2The browser calls the provider directly, for providers that allow
browser calls.
3You pay nothing per request. The user decides where their data
goes.
Fits: developer tools and power users
with a provider account. Know this: the key is stored as plain
data. Bazaar can technically read it, it's in the user's export, and a
careless grant on that collection would share it.