> 99% of all web sites run with a user with full permissions In my professional career it's 0% for public facing apps, the simplest custom CMSs based systems I

> 99% of all web sites run with a user with full permissions In my professional career it's 0% for public facing apps, the simplest custom CMSs based systems I maintain has seperation between database users for a 100MB DB. Many of the newer ones have a sync to read only copies for most of the actions that the app needs to do. 99% sounds horrible, I can't even imagine how you could get to such a state! Sure considering how bad login is handled every where (even in SAML), it's not that surprising.