A legacy Replit database URL was shared

Symptom

Someone pasted DATABASE_URL into a ticket, a chat, or a client. On the legacy Neon database, that string is enough to connect.

Root cause

Replit's connection-details page says the current development database is scoped to the app, and that a leaked development URL on the current infrastructure cannot be used by anyone else. The same page says a development database still on legacy Neon is different: DATABASE_URL contains credentials anyone could use, and you must not paste it in public or in support tickets. If a production connection string was exposed, the page documents regenerating credentials in the Database tool. That creates a new password, immediately invalidates old production connection strings, and can redeploy a supported live deployment.

In this Repl only:

1. Search code for a hardcoded postgres URL or a neon.tech host. Replace it with process.env.DATABASE_URL.
2. If this app is still on the legacy Neon development database and that URL was pasted anywhere, treat it as exposed. Tell me to migrate or rotate. Do not print the URL.
3. If a production connection string was exposed, tell me the Database tool steps to regenerate production credentials, and remind me that old strings stop working immediately.
4. Do not put DATABASE_URL in client code or in a prompt.

Paste this into the coding tool that has your own project open.

2-minute self-check

These steps are for an app you own. Do not run them against someone else's project.

1. In your own Database tool, see whether the development database is current Replit hosting or legacy Neon.
2. Search your own code and chat history for a postgres:// URL. If you find one from legacy Neon or from production, rotate it.
3. After a production regenerate, open your own published app and confirm it reconnects, then update any external SQL client you use.

Sources

• Replit: Connection details