Neon
Security & compliance
Releases
?sslmode=disable in connection string
Part of the Connection hygiene check · fix arrives as a pull request
What it is
A connection string carries ?sslmode=disable, so the client connects to Neon without TLS.
Why it matters
The password is in the connection string, and without TLS both it and the query traffic cross the network in plaintext. Neon is reached over the public internet, so the exposure is not limited to your own infrastructure.
How to fix it
Change it to sslmode=require, or verify-full where the client supports it. If it was disabled to work around a certificate error, fix the trust store rather than removing the encryption.
Run them all on your app
Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.