Neon
Security & compliance
Releases
TLS certificate verification disabled in a production-scoped file
Part of the Connection hygiene check · fix arrives as a pull request
What it is
Certificate verification is disabled in a production-scoped file — an ssl object with rejectUnauthorized: false or equivalent.
Why it matters
The connection is encrypted but unverified, so anything that can answer for the hostname can read the traffic and capture the credentials. It is the specific protection that makes TLS meaningful.
How to fix it
Set rejectUnauthorized: true and supply Neon's CA if the environment's trust store is incomplete. Keep any exception scoped to local development by an environment check, never as the default.
Run them all on your app
Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.