Neon
Releases
Security & compliance
Hardcoded connection string in migration config (not env var)
Part of the Branching & migrations check · fix arrives as a pull request
What it is
A migration tool's configuration contains a literal Neon connection string rather than reading DATABASE_URL from the environment.
Why it matters
Neon connection strings embed the password, so this is a live database credential in the repository and in its history. It also pins migrations to one branch, which is how a test run ends up applying to production.
How to fix it
Rotate the password in the Neon console, then read the connection string from the environment in the migration config so each environment supplies its own.
Run them all on your app
Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.