I got a (***Flask***) backend powering an API that serves ***JSON*** to an ***Angular*** app. 

I love the fact that my backend (algorithms, database) is totally disconnected from my frontend (design, UI) as it could literally run from two distinct servers. However since the view is entirely generated client side everyone can access the ***JSON*** data obviously. Say the application is a simple list of things (the things are stored in a JSON file).

In order to prevent direct access to my database through ***JSON*** in the browser console I found these options :

* Encrypting the data (weak since the decrypting function will be freely visible in the javascript, but not so easy when dealing with minified files)
* Instead of `$http.get` the whole database then filtering with angular, `$http.get` many times (as the user is scrolling a list for example) so that it is programmatically harder to crawl

I believe my options are still weak. How could I make it harder for a hacker to crawl the whole database ? Any ideas ?