>>105634132
>does at least the SQL user you are using have a security permission to only execute stored procedures, and only some of them?
Yes, specifically because the connection string can be easily extracted from managed code. App logins only have access to its specific procs, and procs are only executable by those logins. Also, no sensitive information is stored. I am not completely retarded, only mostly.