database-securitylisted

<!-- Native skill bundle for Claude Code. Generated by `secure-vibe dev regenerate`. --> <!-- Do not edit by hand; the source of truth is skills/database-security/SKILL.md. --> # Database Security Prevent SQL and NoSQL injection, unsafe ORM and raw-query use, over-privileged database identities, weak tenant isolation, and unauthenticated database transport. Use when generating SQL or raw query strings, NoSQL filters, ORM models or queries, database migration files, or connection strings. ## ALWAYS - Bind every untrusted data value through the driver or ORM parameter API. Never place it into SQL with language-level interpolation or concatenation — `+`, f-strings, `%` formatting, `.format()`, JavaScript template interpolation. Driver placeholders (`%s`, `?`, `$1`, `:name`, `@name`) are the binding *mechanism*, not string formatting; confusing the two is how this rule is most often misread. The same applies to values read back out of the database and used to build a later query: stored input is still input, and second-order injection is this bug with a delay. - Prefer the ORM's structured query-expression API over textual SQL. Where raw SQL is genuinely needed, use that framework's documented parameter-binding mechanism and never interpolate untrusted values into it. `references/orm-safe-query-examples.md` carries the verified form per framework. - For SQL structure that cannot be a bind parameter — table and column identifiers, sort direction, sometimes the operator itself