Neon
Security & compliance
Code quality
Neon connection string with embedded password committed to source
Part of the Connection hygiene check · fix arrives as a guide
What it is
A Neon connection string including its password is committed to the repository.
Why it matters
Neon embeds the credential in the URL, so this is a working database login in version control and in every clone. There is no separate password to protect — the string is the access.
How to fix it
Reset the role password in the Neon console immediately, then read the connection string from the environment. Restrict the project's IP allow-list as an additional layer while you confirm nothing was accessed.
Run them all on your app
Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.