don't expose db access code just yet