What it is
SSL is not enforced for database connections, so clients may connect without TLS.
Why it matters
The connection carries your credentials and your data in plaintext to anyone positioned on the network path. Enforcement is the only way to know that every client is actually using TLS rather than merely being able to.
How to fix it
Enable enforce SSL in the database settings, then confirm each client sets sslmode=require or stricter. Verify before enabling, since a client that was connecting in plaintext will start failing.
Run them all on your app
Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.