this is some interesting reading if you've got the time: https://authzed.com/blog/prevent-newenemy-cockroachdb/