Neon
Security & compliance
Code quality
.env.production committed with DATABASE_URL (not gitignored)
Part of the Connection hygiene check · fix arrives as a guide
What it is
An .env.production file containing DATABASE_URL is committed and not covered by .gitignore.
Why it matters
The production database credential is in history and readable by everyone with repository access. Because the filename says production, it is also the first thing anyone browsing the repository would open.
How to fix it
Reset the database password, remove the file with git rm --cached, and add .env* patterns to .gitignore. Move production values into your platform's environment settings.
Run them all on your app
Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.