Conversation

The easiest way to secure a web app is to never ask for nor store any more information about people than you absolutely need to store in order for those people to successfully use your application to their satisfaction.

That should always be part of the design process for your data - what do you absolutely need to know about a user and for how long do you really need to remember it?

The smaller the footprint, the easier it will be to keep secure and so much less damaging should a breach occur.