references/security-and-sql.md

# SQL security and least privilege

Use parameterized values in application queries. Dynamic identifiers such as table/column names cannot generally be bound as values; select them from an explicit allowlist and use dialect-safe identifier quoting. Avoid concatenating untrusted data into SQL.

Do not request raw credentials or expose connection strings, tokens, customer PII or regulated data in test samples. Work with synthetic/redacted fixtures wherever possible.

Review row-level policies, masking, column grants, service role scope, audit visibility and tenant keys. In multi-tenant queries, filtering by tenant ID in only one table may leak data through unscoped joins; test data isolation at the authorization boundary, not just in the frontend.

GRANT/REVOKE, policy modifications or bypass roles are consequential writes. Draft least-privilege changes with explicit principals and object scopes, but do not execute or weaken restrictions without approval.