Does AppSheet enforce Editable_If on the server when processing app sync requests?

AppSheet AppSheet Q&A
1

Does AppSheet enforce Editable_If on the server when processing app sync requests?

For example, if a column has Editable_If = FALSE, could a malicious user capture an update request in the browser’s Network tab, manually change the payload to modify that column, and resend it?

Would AppSheet reject the change server-side, or is Editable_If only a client-side restriction?

2

Based on my testing, I was able to confirm that Editable_If is evaluated only on the client side and should not be considered a server-side security control.

3

For reference: