Neon
Security & compliance
Releases
Missing sslmode=require in production config
Part of the Connection hygiene check · fix arrives as a pull request
What it is
A production connection string omits sslmode=require, leaving the TLS decision to the client library default.
Why it matters
Defaults differ between drivers and versions, so whether the connection is encrypted depends on which client happens to be running. That is not something to leave implicit for a credential crossing the internet.
How to fix it
Add sslmode=require explicitly to every production connection string so the behaviour is stated rather than inherited.
Run them all on your app
Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.