Database connections use SSL/TLS

A database connection without SSL transmits queries, parameters, and result sets as cleartext on the network. Any host on the path between the application server and the database — a shared VPC, a cloud provider's internal network, a compromised router — can read and modify query traffic. This is CWE-319 (cleartext transmission of sensitive information) and OWASP A02. The failure mode is especially dangerous because the exposed data includes authentication credentials passed as query parameters and result sets containing all user PII stored in the database. rejectUnauthorized: false is equally dangerous: it encrypts the channel but does not validate the server certificate, leaving the connection open to man-in-the-middle substitution.

Add ?sslmode=require to connection strings and ensure rejectUnauthorized is never set to false in production SSL config. For managed databases, verify SSL is enforced at the platform level.

// pg Pool — require SSL in production
export const pool = new Pool({
  connectionString: process.env.DATABASE_URL,
  ssl: process.env.NODE_ENV === 'production'
    ? { rejectUnauthorized: true }
    : false
})

# .env.example — include sslmode in connection string template
DATABASE_URL=postgresql://USER:PASSWORD@HOST:PORT/DATABASE?sslmode=require

Search for dangerous patterns: grep -rn 'rejectUnauthorized.*false\|sslmode=disable\|NODE_TLS_REJECT_UNAUTHORIZED' . — any match in production config is a critical misconfiguration. For Neon serverless, the HTTP driver uses TLS by default with no additional config required.