Neon Releases Stability Security & compliance

CI creates branch but sets wrong DATABASE_URL

Part of the Branching & migrations check · fix arrives as a guide

What it is

CI creates a Neon branch for the run but the job's DATABASE_URL points somewhere else — typically still at production.

Why it matters

The isolated branch is created and ignored while the test suite runs against real data. Test fixtures, truncations, and migrations all land on production, and the run reports success.

How to fix it

Capture the connection string the branch-creation step outputs and set DATABASE_URL from it for the rest of the job. Assert in CI that the host contains the branch identifier before any migration runs.

Run them all on your app

Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.