You need to treat clients as zero-trust. Your db is just a vector for DOS attack if you don't.