Database Security: Best Practices for Production Apps

Database Security: Best Practices for Production Apps

Your database is the most valuable asset in your stack. A breach doesn't just expose data — it can destroy user trust, trigger regulatory penalties, and end products. Yet database security is frequently under-prioritized until something goes wrong. This guide covers the essential practices every team should follow before going live.

PandaStack supports PostgreSQL, MySQL, Redis, and MongoDB deployments with built-in network isolation, encryption, and access controls — so you have a secure foundation to build on.

Step 1: Never Expose Databases to the Public Internet

Your database should never have a public IP. Restrict access to your application servers only, using private networking or VPC peering.

On PandaStack, provisioned databases are deployed in isolated private networks by default. They are only reachable from within the same project environment — no public endpoint is exposed.

Step 2: Use Strong, Unique Credentials

Avoid default usernames like admin, root, or postgres. Generate strong passwords and rotate them regularly:

# Generate a strong password
openssl rand -base64 32

Store credentials in environment variables — never hardcode them in source code or config files committed to Git.

Step 3: Apply the Principle of Least Privilege

Create dedicated database users for each service with only the permissions they need:

-- PostgreSQL example
CREATE USER app_user WITH PASSWORD 'strong_password';
GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA public TO app_user;

-- Read-only analytics user
CREATE USER analytics_user WITH PASSWORD 'another_strong_password';
GRANT SELECT ON ALL TABLES IN SCHEMA public TO analytics_user;

Never use a superuser account for application connections.

Step 4: Enable Encryption in Transit

Require TLS for all connections to your database. In PostgreSQL:

# postgresql.conf
ssl = on
ssl_cert_file = 'server.crt'
ssl_key_file = 'server.key'

In your connection string, enforce SSL:

DATABASE_URL=postgresql://user:pass@host:5432/db?sslmode=require

PandaStack database deployments enforce TLS by default on all connections.

Step 5: Encrypt Data at Rest

Enable storage-level encryption for your database volumes. Most managed database services do this automatically. For self-managed databases, use filesystem-level encryption (e.g., LUKS on Linux).

Step 6: Prevent SQL Injection

SQL injection remains one of the top attack vectors. Always use parameterized queries — never concatenate user input into SQL strings:

// Wrong
const query = `SELECT * FROM users WHERE email = '${email}'`;

// Right (using pg library)
const query = 'SELECT * FROM users WHERE email = $1';
const result = await client.query(query, [email]);

Use an ORM like Sequelize, Prisma, or TypeORM to further reduce the risk.

Step 7: Enable Audit Logging

Log all database access and mutations. In PostgreSQL, enable the pgaudit extension:

CREATE EXTENSION pgaudit;

Configure it to log DDL, DML, and connection events. Ship logs to a centralized log management system.

Step 8: Set Up Automated Backups

Backups are your last line of defense against data loss — from ransomware, accidental deletion, or hardware failure.

# Manual PostgreSQL backup
pg_dump -Fc mydb > mydb_backup.dump

# Restore
pg_restore -d mydb mydb_backup.dump

PandaStack database deployments include automated daily backups with point-in-time restore capability. Configure backup retention in the dashboard at [dashboard.pandastack.io](https://dashboard.pandastack.io).

Step 9: Monitor for Anomalies

Set up alerts for unusual activity: queries running longer than expected, connection count spikes, failed authentication attempts. PandaStack's built-in monitoring and alert system lets you configure thresholds and receive notifications without any extra tooling.

Step 10: Regularly Patch and Update

Database software receives security patches regularly. Subscribe to security advisories for your database engine and apply updates on a defined schedule.

Deploying Secure Databases on PandaStack

PandaStack provisions PostgreSQL, MySQL, Redis, and MongoDB databases with private networking, TLS, and automated backups:

npm install -g @pandastack/cli
panda db:create --type postgresql --plan starter

Full documentation at [docs.pandastack.io](https://docs.pandastack.io).

Summary

Database security requires defense in depth: network isolation, strong credentials, least privilege, encryption, injection prevention, auditing, and backups. Implement all of these — not just a subset — before your app touches real user data.