Neon
Security & compliance
Code quality
DATABASE_URL logged / included in error context
Part of the Connection hygiene check · fix arrives as a pull request
What it is
DATABASE_URL is written to a log line or attached to an error report — often by logging the whole config or environment object.
Why it matters
The URL contains the password, so the credential is now in your logging platform and your error tracker, which are usually retained longer and accessible to more people than the database itself.
How to fix it
Redact the value at the logger and scrub it from error context before sending. Rotate the password, since it is already in whatever retention window those systems keep.
Run them all on your app
Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.