For passwords, my method is individually salted and one way hash will eliminate most attempts, pretty much leaving brute forcing the most efficient way. However, it's known that people use common passwords like 'password1'. For more paranoid security, read documentation, discussions and even black discussions regarding the technology you use if you really want to lock down everything. Eventually it'll be a performance/usability vs security compromise in some cases.

I suggest a failure plan to prepare for security failures including several PR messages depending on severity of failure even if you do not know if you're compromised.

It's highly unlikely that you will be able to avoid potential leaks.