Your web app doesn’t need the database root user

I still find production apps connecting to MySQL or PostgreSQL as root. It works, so nobody changes it. But it means one SQL injection or one leaked .env file gives an attacker every database on the server, and sometimes files on disk too.

The fix takes ten minutes:

1. One user per app, with access only to that app’s database.
2. Only the rights it uses at runtime: usually SELECT, INSERT, UPDATE, DELETE. No DROP, no GRANT, no FILE.
3. A separate user for migrations, used during deploys, not by the running app.
4. Limit where it can connect from (the app server, not %).
5. Reporting and analytics get read-only users, ideally on a replica.

In MySQL that’s a CREATE USER and a GRANT on appdb.*. In PostgreSQL, a role with privileges on one schema.

Least privilege doesn’t stop the bug. It decides how bad the bug gets.