Neon project accepts connections from any IP — no allowlist and public connections not blocked
Part of the Cost & ops health check · fix arrives as a guide
What it is
The project has no IP allow-list and does not block public connections, so the database accepts connections from any address.
Why it matters
The password is the only thing between the internet and your data, and Neon endpoints are predictable enough to enumerate. This puts the database in scope for every credential-stuffing sweep running continuously.
How to fix it
Add an IP allow-list covering the ranges your application connects from, and enable blocking of public connections. Serverless clients have no stable egress address, so give them one — a NAT gateway, a static-egress proxy, or a VPC-connected runtime. The connection pooler does not help here: allow-list rules apply to pooled and direct routes alike.
Run them all on your app
Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.