App user cannot DROP DATABASE

Severity: Critical

This is a guided manual check.

Prompt user:

Please provide the SHOW GRANTS output for the application database user.

For PostgreSQL: \du app_user or check pg_roles

For MySQL: SHOW GRANTS FOR 'app_user'@'%';

Verify:

• No DROP privilege on database level
• No ALL PRIVILEGES on database level
• Ideally limited to: SELECT, INSERT, UPDATE, DELETE on specific tables

Pass criteria:

• App user cannot DROP DATABASE
• Permissions are scoped to necessary operations only

Fail criteria:

• DROP privilege exists
• ALL PRIVILEGES granted at database level

Evidence to capture:

• GRANTS output for app user
• Confirmation of restricted permissions

Cross-reference with:

• DB-004 (should be one of the documented users)

---