Principle of least privilege for database and service accounts

Applications running with database superuser or admin credentials mean any SQL injection, code execution, or insider query can drop tables, read all data, or modify any row without restriction. CWE-272 (Least Privilege Violation) and OWASP A01 (Broken Access Control) cover this. NIST 800-53 AC-6 mandates least-privilege for all system accounts. A postgres root connection string in DATABASE_URL means a single RCE or injection turns into a full database wipe. API keys scoped to all operations mean one leaked key — from logs, from a debug endpoint, from a shoulder-surf — gives an attacker full service access.

Create a dedicated database user with only the permissions the application actually needs:

CREATE USER app_user WITH PASSWORD 'strong_password';
GRANT CONNECT ON DATABASE mydb TO app_user;
GRANT USAGE ON SCHEMA public TO app_user;
GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA public TO app_user;
GRANT USAGE, SELECT ON ALL SEQUENCES IN SCHEMA public TO app_user;
-- Do NOT grant: CREATE, DROP, ALTER, TRUNCATE, or pg_superuser

For Stripe, use the Stripe Dashboard to create restricted API keys scoped only to the operations your server performs (e.g., charges:write only, not customers:read_write). Store the restricted key in STRIPE_SECRET_KEY, not the full secret key.