Backend

The application code and services that run in a trusted server-side environment, commonly handling authorization, data, jobs, and private credentials.

A backend can receive requests, enforce permissions, read or write stored data, call private services, run scheduled work, and return a result. It may run on a long-lived server, a serverless function, an edge runtime, or several services. A to-do app's save operation belongs behind this trusted boundary because the browser cannot be trusted to decide which account may write which record.

Builder example

When you ask an AI to add a feature that touches stored data or a paid service, you are asking it to write backend code. A password reset is a good example: the browser collects the email, but the backend has to verify the account exists, generate a one-time link, and send the message through an email service using a secret key. If that key sat in the frontend, anyone could read it from their browser and send mail as you. Knowing which side a task belongs on tells you where a bug or a leak can hide.

Common confusion: Backend does not mean secure by default. It is the place where secrets and authorization can be enforced, but logs, responses, configuration, and vulnerable endpoints can still expose them.