Neon
Security & compliance
Code quality
Releases
Stability
Connection hygiene
Where your database URL has ended up.
Overview
A Neon connection string carries the password inline, so anywhere the URL goes, the credential goes. This check tracks it across the repo — committed files, logs, error contexts, test fixtures — and reads the TLS parameters on each one.
What it looks for
- Connection strings with embedded passwords committed to source
- .env.production committed and not gitignored
- sslmode=disable, or certificate verification switched off in production paths
- DATABASE_URL written to logs or attached to error context
- The same endpoint shared across dev and prod, and connection strings in test fixtures
Why it matters
A committed connection string is a live database credential in git history. sslmode=disable sends that credential in plaintext, and the same endpoint hostname in dev and prod means a test run can write to production.
Rules in this check
| What it reports | Fix path |
|---|---|
| Neon connection string with embedded password committed to source | Guide |
| .env.production committed with DATABASE_URL (not gitignored) | Guide |
| ?sslmode=disable in connection string | Pull request |
| TLS certificate verification disabled in a production-scoped file | Pull request |
| DATABASE_URL logged / included in error context | Pull request |
| Same endpoint hostname in dev + prod env files | Guide |
| Missing sslmode=require in production config | Pull request |
| Connection string in test fixture / snapshot | Guide |
How the fixes arrive
Pull requestLow-risk changes arrive as a pull request on a lumioguard branch, with a breakage analysis attached. You review and merge it.
GuideChanges only you can make safely arrive as a step-by-step guide you can follow yourself or hand to your coding agent.
Run them all on your app
Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.