We've been using https://dbdiagram.io/, which also has an open-source markup language: https://github.com/holistics/dbml
on a more serious note, everyone should have a little utility belt of lists, hand curated and intimately known. they are an extension of me at this point.
Security: well, see above—knowing what data is stored determines your value as a target.
Now is it the _best_ way to target an adversary? Probably not.
Edit: Damn, it really look like they were copying dbdiagram.io, down to the FK relationship syntax. Not cool.