I am studying CartoDB, and am wondering:
To what extent is CartoDB SQL API secure?
From their description about authentication, you can submit entire SQL statements in the URL by appending the api_key to it as follows.
https://{username}.carto.com/api/v2/sql?q={SQL statement}&api_key={api_key}
When you use it in HTML/JavaScript, what prevents this key from being seen by others and used to change your tables (or perform SQL injection)?
I have seen API keys used elsewhere (e.g. Google Map) for counting visits and charging fees. But I don't quite understand the concept of using API keys in the URL for authentication. How does the security model work here? (Or what's the correct way to make security work?)
A related question is, if CartoDB is set up and used in a intranet (if possible), how is one supposed to configure security for the CartoDB/Postgres instance?