Repository navigation
Security issue - create @tanstack/start with neon db exposes database url to client #287
Description
Which project does this relate to?
Create Tanstack App
Describe the bug
Creating a new tanstack start project with pnpm create @tanstack/start@latest per the docs will generate a project with the environment variables for the database prefixed with VITE_ -- this means that they are sent to the client.
Being new to vite I had no idea this was the case. Luckily my app is not to production yet, but I'd expect a lot of people might overlook this when building a new app with this tool.
Your Example Website or App
https://tanstack.com/start/latest/docs/framework/react/quick-start
Steps to Reproduce the Bug or Issue
- Follow the quick start instructions
- Expose your DB variables to the client
Expected behavior
Do not expose sensitive variables to the client
Screenshots or Videos
No response
Platform
Any
Additional context
No response
Activity
billy-the-ape commentedon Jan 12, 2026
Appears to have been changed in this commit: 72f692c#diff-bb40100535735e324c0b4945a29931c8dfe90bbc4b7a97ef21a246abb04a5d5e
vkalahas commentedon Feb 4, 2026
I saw this too and it concerned me so I didn't use the Neon option and instead manually installed. We need to get more attention on this. I was also under the impression that
VITE_environment variables were sent to the client.tannerlinsley commentedon Feb 13, 2026
Fixed by PR #355. Neon scaffolds now use server-only DATABASE_URL variables (including plugin wiring and db client usage), so database URLs are no longer generated under VITE_ env keys.
feat(react-doctor): add 5 more TanStack Start rules for exhaustive co…