Neon 41 rules 5 checks

Neon Postgres checks

Pools that let compute suspend, connection strings that stay out of git, branches that do not bill all night. These are the rules lumioguard runs against a connected Neon project.

Neon 6 rules

Branching & migrations

Migrations pointed at the wrong branch, or with no way back.

ReleasesSecurity & complianceStability Open
Neon 8 rules

Connection hygiene

Where your database URL has ended up.

Security & complianceCode qualityReleases Open
Neon 5 rules

Connection pooling

Serverless functions versus a Postgres connection limit.

PerformanceStabilityCost Open
Neon 16 rules

Cost & ops health

Live Neon consumption, retention, and access posture.

Security & complianceCostStability Open
Neon 6 rules

Idle compute cost

Why your database never scales to zero.

CostPerformanceStability Open

Every Neon rule

Branching & migrations

6 rules
Branch created in PR workflow with no delete-on-close NeonBranching & migrations Hardcoded connection string in migration config (not env var) NeonBranching & migrations Destructive migration drops table with no rollback path NeonBranching & migrations DELETE FROM without WHERE in migration NeonBranching & migrations PII or large seed data inside migration file NeonBranching & migrations CI creates branch but sets wrong DATABASE_URL NeonBranching & migrations

Connection hygiene

8 rules
Neon connection string with embedded password committed to source NeonConnection hygiene .env.production committed with DATABASE_URL (not gitignored) NeonConnection hygiene ?sslmode=disable in connection string NeonConnection hygiene TLS certificate verification disabled in a production-scoped file NeonConnection hygiene DATABASE_URL logged / included in error context NeonConnection hygiene Same endpoint hostname in dev + prod env files NeonConnection hygiene Missing sslmode=require in production config NeonConnection hygiene Connection string in test fixture / snapshot NeonConnection hygiene

Connection pooling

5 rules
Edge route uses pg driver — Neon connections will exhaust on cold starts NeonConnection pooling Direct endpoint instead of -pooler in serverless NeonConnection pooling new Pool/new Client inside handler body (not singleton) NeonConnection pooling max pool size > 10 in serverless context NeonConnection pooling Missing @neondatabase/serverless in edge (general) NeonConnection pooling

Cost & ops health

16 rules
Compute ran continuously for 30 days (no scale-to-zero) NeonCost & ops health Storage growing — likely orphaned branch data NeonCost & ops health Repeated apply_migration failures NeonCost & ops health Failed-op ratio > 10% NeonCost & ops health Neon project accepts connections from any IP — no allowlist and public connections not blocked NeonCost & ops health IP allowlist set but public connections not blocked NeonCost & ops health Neon PITR retention window is less than 1 day NeonCost & ops health PITR retention < 7 days (production) NeonCost & ops health No spend quota on non-trial project NeonCost & ops health Postgres version end-of-life (< 14) NeonCost & ops health Ephemeral branch past expiry date NeonCost & ops health Preview/feature branch accumulating compute with no expiry NeonCost & ops health Non-primary branch > 1 GiB logical size NeonCost & ops health Non-primary branches hold 5× primary storage NeonCost & ops health Unprotected role on the primary/protected branch NeonCost & ops health IP allow-list not scoped to protected branches NeonCost & ops health

Idle compute cost

6 rules
Neon autosuspend disabled — compute bills as always-on NeonIdle compute cost Autosuspend timeout > 1 h on non-prod branch NeonIdle compute cost Pinned min/max CU (no scale-down) NeonIdle compute cost Pool with idleTimeoutMillis: 0 or missing (long-lived process) NeonIdle compute cost Background poll < 5 min interval hitting DB NeonIdle compute cost Health-check SELECT used by uptime monitor NeonIdle compute cost

Run them all on your app

Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.

Start for Free View pricing