Database study
The data arm surveys tables, relationships, the foreign keys that actually exist, money and date types and soft deletes, before anyone writes a query.
Deliverable: database map, with what exists and what is missingOcto for databases · data arm
No one changes the database before understanding it.
Constraints and foreign keys give you control over the data; money calls for an exact type. Octo's data arm works at this step: it studies tables, relationships, actual foreign keys, money and date types and soft deletes before any query or change. The development arm only changes the database when the approved plan says so, with the rollback ready. Access to the production database is authorized by the tech lead.
ArmDataworks at this step
Moneynumericexact type in PostgreSQL
Sources5listed at the end of the page
01
What Octo does in the database.
Four possible deliverables. Migrations, the model and production access are approved by the tech lead.
Migration with rollback
When the plan calls for a database change, the migration comes with its rollback, and a bulk change shows up front how many rows it will touch.
Deliverable: migration and rollback for approvalMissing constraints
Points out where the database relies only on the code: a foreign key that doesn't exist, a money column with an inexact type, a field that should be required.
Deliverable: list of proposed constraintsPersonal data and logs
Maps where personal data lives and checks that passwords, session identifiers and sensitive personal data don't end up in the log.
Deliverable: personal data map for the data protection officer
02
Eight arms, one well-understood database.
The same Octo cycle, applied to this step. Each arm has a narrow role; your company's tech lead is in charge and approves.
-
Discovery
Finds the database
Which database, which version, where it runs and how the system connects to it.
-
Data
Studies the model
Tables, relationships, actual foreign keys, money, dates and soft deletes.
-
Security
Protects the data
Personal data, credentials and what the log records.
-
Architecture
Plans the change
Migration, rollback and order: database before code.
-
Development
Changes only with a plan
The migration runs with the rollback ready and the row count shown beforehand.
-
Review
Checks the result
Queries through the real path after the migration, by content.
-
Release
Orders the release
The migration ships before the code that depends on it.
-
Documentation
Records the model
The database map goes into the system dossier.
Octo studies and proposes; approving migrations and the model, authorizing access to the production database and deciding retention and handling of personal data with the data protection officer are up to your team.
03
What Octo checks in the database.
Reference rules. The documentation for the database your company uses remains the reference; the type points come from PostgreSQL.
| Rule | What Octo checks | Basis |
|---|---|---|
| Referential integrity | Foreign key declared wherever there is a relationship | PostgreSQL, constraints |
| Money | Exact type (numeric), never real or double precision | PostgreSQL, numeric types |
| Injection | Parameterized query | OWASP Top 10 2025, A05 |
| Log | No passwords, no session identifiers, no sensitive personal data | OWASP, Logging Cheat Sheet |
04
From request to routine.
Three steps. Each one only makes sense once the previous one has shown results on your team.
A proposal, not a promise
Database map
The data arm studies the database you already have, without changing anything.
- Actual tables and relationships
- Money, dates and soft deletes
- Personal data
Migrations with rollback
Every database change now comes with a rollback and a count beforehand.
- Migration and rollback
- Database before code
Constraints in the database
The missing constraints are added gradually, each one in its own task.
- Declared foreign keys
- Corrected types
05
Confirmed by source.
Each point below has a source published by the organization responsible for the standard, the specification or the tool, or in Brazilian federal law. The sources are in the next section.
7
points with a published source, each with its reference alongside.
- ConfirmedConstraints
- In PostgreSQL, constraints give you as much control over the data in your tables as you wish; types alone limit very little.Source: PostgreSQL, constraints
- ConfirmedForeign key
- A foreign key maintains referential integrity between two related tables.Source: PostgreSQL, constraints
- ConfirmedMoney
- The numeric type is especially recommended for storing monetary amounts and other quantities where exactness is required.Source: PostgreSQL, numeric types
- ConfirmedInexact types
- The real and double precision types are inexact, variable-precision numeric types.Source: PostgreSQL, numeric types
- ConfirmedInjection
- Injection remains in the 2025 OWASP Top 10, as A05:2025.Source: OWASP, Top 10 2025
- ConfirmedLGPD
- Brazil's LGPD requires technical and administrative security measures to protect personal data.Source: Planalto, Law 13.709/2018, art. 46
- ConfirmedWhat stays out of the log
- Do not log authentication passwords, session identification values or sensitive personal data.Source: OWASP, Logging Cheat Sheet
06
What Octo does and what stays with you.
Octo prepares everything, but does not sign. The document of record stays with whoever is accountable for it.
Octo prepares
Maps, plans, codes on the task branch, reviews with evidence and prepares the release: plans, code, reviews, security reports and the system dossier.
Deliverable: material ready for reviewYour team reviews
Whoever is in charge is the company's tech lead or senior developer: they approve the plan, review the PR and merge it. Nothing goes to production without their approval.
Step: approval by whoever is in chargeWho signs and is accountable
Octo does not sign and is not accountable for the system. The tech lead accepts the risk and is accountable for the system in production; a security report or opinion is signed by a professional at the company.
Accountable: the company's tech lead
07
Sources.
PostgreSQL documentation, OWASP and federal legislation published on the Planalto website. Accessed October 31, 2026.
- PostgreSQL: constraintsConstraints and foreign keys
- PostgreSQL: numeric typesnumeric for money; real and double precision are inexact
- OWASP: Top 10, 2025 editionThe ten web application risks
- Planalto: Law 13.709/2018 (LGPD)Art. 46
- OWASP: Logging Cheat SheetWhat not to log
Your database, understood before anyone touches it.
The assessment starts with the database you already have, read-only, without changing anything. You get the map and decide with it in hand.