I hereby claim:

• I am albogdano on github.
• I am albogdano (https://keybase.io/albogdano) on keybase.
• I have a public key whose fingerprint is DFE3 1314 C10B 8C67 E891 DD0A A95C EA0C 995D AA0F

To claim this, I am signing this object:

• Use encryption for data identifying users and sensitive data like access tokens, email addresses or billing details if possible (this will restrict queries to exact match lookups).
• If your database supports low cost encryption at rest (like AWS Aurora), then enable that to secure data on disk. Make sure all backups are stored encrypted as well.
• Use minimal privilege for the database access user account. Don’t use the database root account and check for unused accounts and accounts with bad passwords.
• Store and distribute secrets using a key store designed for the purpose. Don’t hard code in your applications.
• Fully prevent SQL injection by only using SQL prepared statements. For example: if using NPM, don’t use npm-mysql, use npm-mysql2 which supports prepared statements.

• Ensure that all components of your software are scanned for vulnerabilities for every version pushed to production. This means O/S, libraries and packages. This should be automated