Database Security Checklist: 18-Item Guide for Production

TL;DR

Eighteen items, grouped by what they actually protect: credentials, access control, connections, queries, and backups. Five of them are the ones that stop a breach, and they're listed first. Do those before you launch. The rest can wait a week.

Your database is where all the stuff you actually care about lives: user data, payment info, the works. Misconfigure it and you have the fastest path to a breach that ends up on Hacker News. Postgres, MongoDB, Supabase, Firebase, it doesn't matter. These items apply.

Quick Checklist (5 Critical Items)

Use strong, unique database passwordsGenerate random passwords with 20+ characters

Enable Row Level Security (Supabase/PostgreSQL)RLS must be enabled AND have policies on all tables

Use SSL/TLS for all connectionsVerify connection strings include sslmode=require

Use parameterized queriesNever concatenate user input into SQL

Enable automated backupsUse your provider's backup feature or implement daily backups

Authentication & Credentials 4

Use strong, unique database passwordsGenerate random passwords with 20+ characters. Never reuse passwords. How to secure database credentials

Store credentials in environment variablesNever hardcode database URLs or passwords in code. How to configure env variables

Use separate credentials per environmentDevelopment, staging, and production should have different database credentials. How to manage environment credentials

Rotate credentials periodicallyChange database passwords at least annually, or after team member departures. How to rotate credentials

Access Control 5

Enable Row Level Security (Supabase/PostgreSQL)RLS must be enabled AND have policies on all tables. RLS without policies blocks all access. How to set up Supabase RLS

Configure Firebase Security RulesFirestore and Realtime Database need explicit rules. Default rules allow no access. How to configure Firebase rules

Implement least privilege principleDatabase users should only have permissions they need. Avoid using admin accounts. How to implement least privilege

Test data isolation between usersLog in as User A and verify you cannot access User B's data by modifying IDs. How to test data isolation

Restrict network accessDatabase should only be accessible from your application servers, not the public internet. How to restrict network access

Connection Security 3

Use SSL/TLS for all connectionsVerify connection strings include sslmode=require or equivalent. How to enable database SSL

Use connection poolingPrevent connection exhaustion attacks with connection limits and pooling. How to set up connection pooling

Set connection timeoutsConfigure idle and query timeouts to prevent hanging connections. How to configure timeouts

Query Security 3

Use parameterized queriesNever concatenate user input into SQL. Use prepared statements or ORM methods. How to prevent SQL injection

Validate and sanitize inputsValidate data types and lengths before database operations. How to validate inputs

Limit query resultsAlways use LIMIT clauses to prevent returning entire tables. How to limit query results

Backup & Recovery 3

Enable automated backupsUse your provider's backup feature or implement daily automated backups. How to set up backups

Test backup restorationActually restore from a backup to verify it works. Untested backups are not backups. How to test restoration

Store backups securelyEncrypt backups and store in a different location than your primary database. How to secure backups

Database-Specific Considerations

For Supabase: enable RLS on every table, then write a policy for each operation you allow. SELECT, INSERT, UPDATE and DELETE each need one. And keep the service_role key on the server, always, because it bypasses RLS completely.

For Firebase: the default security rules block all access, so you have to write your own. Test them in the Rules Simulator in the Firebase Console before you deploy. A rule that looks right and isn't is the usual way this goes wrong.

For MongoDB: turn on authentication, restrict network access, and validate documents before you insert them. NoSQL injection is real.

What is the most important database security measure?

Access control is the most critical database security measure. This includes strong authentication, authorization rules (like Supabase RLS or Firebase Security Rules), and the principle of least privilege. Without proper access control, attackers with database access can read or modify any data.

Should I encrypt my database?

Yes, use encryption at rest and in transit. Most managed database providers (Supabase, PlanetScale, Neon) encrypt data at rest by default. Always use SSL/TLS for connections. For highly sensitive fields like SSNs or payment data, consider application-level encryption as an additional layer.

How often should I backup my database?

It depends on how fast your data changes and how much of it you can afford to lose. Daily is the floor for most production apps. If your data moves faster than that, look at point-in-time recovery. And test the restore. A backup you can't restore from is worthless.