# LeadPilot — Database Security & Hardening Architecture

**Document Version:** 1.0.0 (Phase 5 Database Architecture Lock)  
**Status:** Approved & Formally Recorded  

---

## 1. Database User Privileges & Hardening

* **Least Privilege DB User:** The application database user (`leadpilot_app`) is granted strictly required permissions only:
  ```sql
  GRANT SELECT, INSERT, UPDATE, DELETE, CREATE, DROP, INDEX, ALTER ON leadpilot_db.* TO 'leadpilot_app'@'localhost';
  REVOKE ALL ON *.* FROM 'leadpilot_app'@'localhost';
  ```
* **No Superuser / Root in App Config:** The Laravel `.env` file MUST NEVER contain the MySQL `root` user credentials.

---

## 2. Secrets Storage & Encryption Standards

* **API Keys:** Plaintext Bearer tokens are NEVER stored. Only the SHA-256 hash (`hash('sha256', $plainSecret)`) is persisted in `api_keys.token_hash`.
* **Webhook Verification Secrets:** Webhook verification HMAC keys are stored hashed or encrypted via Laravel’s `Crypt::encryptString()` when retrieval is required for HMAC computation.
* **Passwords:** 100% of user passwords use `bcrypt` (work factor 12) via Laravel's `Hash::make()`.
* **SQL Injection Immunity:** 100% of database queries execute through Eloquent ORM or parameterized PDO prepared statements (`$pdo->prepare()`), eliminating SQL injection vectors.