Grant MySQL privileges

The running application needs to read and change rows. It does not need to create or drop tables:

GRANT SELECT, INSERT, UPDATE, DELETE
ON notes_app.*
TO 'notes_app'@'localhost';

The migration account changes the schema. It also needs row access for backfills:

GRANT SELECT, INSERT, UPDATE, DELETE,
  CREATE, ALTER, INDEX, DROP, REFERENCES
ON notes_app.*
TO 'notes_migrator'@'localhost';

Neither account receives privileges on *.*. A leaked application credential is now limited to one database and cannot change its tables.

Test the boundary by connecting as notes_app and trying:

DROP TABLE notes;

MySQL should return an access-denied error. A failed dangerous action proves the restriction works.