My client asked me to create an application using Electron both for the frontend and backend. I need to implement some API to get or post datas, but i can't seem to find out where is the safest way to implement them. I implemented them in the preload.js file, like this (using express js and postgresql and sequelize):

app.get('/users', async(req, res) => {
   try {
      const users = await User.findAll();
      return res.json(users);
   }catch (e) {
      console.log(e);
      return res.status(500).json({err: 'something went wrong'})
   }
});

But I've been reading that some malicious users could access the API in the preload file and run code on the user machine, I wanted to ask you where should I implement these APIs if there's a standard architecture for projects like this. Thank you.