database-securitylisted

<!-- Native skill bundle for Claude Code. Generated by `secure-vibe dev regenerate`. --> <!-- Do not edit by hand; the source of truth is skills/database-security/SKILL.md. --> # Database Security Prevent SQL injection, ORM misuse, credential leaks; enforce least-privilege DB users and safe migrations ## ALWAYS - Use parameterized queries / prepared statements for any SQL that touches user-controlled values. Pass values as parameters, never via string concatenation or formatting (`%s`, `+`, template literals). - Use the ORM's safe query API. In SQLAlchemy: `session.execute(text(":id"), {"id": user_id})`. In Django: ORM methods, `Model.objects.filter(...)`. In Sequelize / Prisma / SQLAlchemy core: `.where({ ... })` builders. In Go: `db.QueryContext(ctx, "select ... where id = $1", id)`. - Validate that identifier columns / table names — which can't be parameterized — come from a hard-coded allowlist, not from user input. - Use a dedicated database user per application with the minimum grants needed. Web apps that only read shouldn't have `INSERT`/`UPDATE`/`DELETE`. Migration jobs run as a separate `DDL`-capable user. - Enable Row-Level Security (Postgres `CREATE POLICY` / Supabase RLS / Azure SQL RLS) for multi-tenant tables and set the tenant context per session. - Pull DB credentials from a secret manager or env var injected at start — never from a committed `database.yml` / `.env`. Rotate on schedule. - Use TLS to the database (`sslmode=require` for Postgres, `requireSS