No database is completely safe. A well-run database environment is one where risks are known, prioritised and actively controlled: software is supported and patched, access is restricted and attributable, data is protected, activity is monitored and recovery is tested. Security is the ability to manage and recover from threats, not a claim that threats will never occur.