Two questions decide many production incidents: what can the app's database account do if someone breaks in, and how many connections hit the server at the same moment?