Audit how my database is exposed on the network and how the app connects to it. Check the host's network settings, any bind addresses, firewall or security group rules, and the connection string options. Verify: the database port is not open to the public internet (it should be reachable only from the app's network, security group, or private subnet; if my host exposes it publicly by default, restrict it now); connections use TLS and actually verify the certificate, not just encrypt (look for flags like sslmode=require versus verify-full, rejectUnauthorized: false, or tlsAllowInvalidCertificates, which silently disable the verification and leave the connection open to interception); and the connection string lives in an environment variable, not in code or committed config. Don't change firewall rules so broadly that deploys or legitimate tooling lose access; note what needs the access and scope to that. If TLS verification requires installing the provider's CA certificate, wire that up properly instead of disabling verification. Deliver: the exposure findings, the network restrictions applied, the TLS configuration with verification enabled, and a test: attempt a connection from outside the allowed network and confirm it fails, then confirm the app's connection verifies certificates by trying one with an invalid cert.