·
Last changedVersion:
This version passed the hardening gate. Hardening applied 5 targeted changes and preserved all other text. Classified findings before hardening: 3. Classified findings closed: 3. Classified findings remaining: 0. Unclassified scanner findings remaining: 0. Review findings closed: 13. Review findings remaining: 5.
1
2
None
Expand | File | Group | Subtype | Severity | Status |
|---|---|---|---|---|---|
SKILL.md | Sensitive Data & Secret Exposure | Agent snooping | Medium | Closed | |
SKILL.md | Malicious Code & Command Execution | — | Low | Closed | |
SKILL.md | Supply Chain & Install-Time Trust | Install-time download and execute | Low | Closed |
3 findings
FIRST: Use the parent neon skill for a Neon overview, getting started with Neon, Neon development best practices, and more.
Guide the user through diagnosing and fixing application-side query patterns that cause excessive data transfer (egress) from their Postgres database. Most high egress bills come from the application fetching more data than it uses.
Work the four steps in order: diagnose which queries transfer the most data, analyze the codebase behind them, fix the anti-patterns, then verify nothing broke and the transfer actually dropped.
Identify which queries transfer the most data. The primary tool is the pg_stat_statements extension.
If this errors, the extension needs to be created:
On Neon the extension is available by default, but it may still need this CREATE EXTENSION step.
Stats are cleared when a Neon compute scales to zero and restarts. If the stats are empty or the compute recently woke up:
If the user has stats from a production database, use those. If they have no access to production stats, proceed to Step 2 and analyze the codebase directly — code-level patterns are often sufficient to identify the worst offenders.
Run these to identify the top egress contributors. Focus on queries that return many rows, return wide rows (JSONB, TEXT, BYTEA columns), or are called very frequently.
Queries returning the most total rows:
Queries returning the most rows per execution (poorly scoped SELECTs, missing pagination):
Most frequently called queries (candidates for caching):
Longest running queries (not a direct egress measure, but helps identify problem queries during a spike):
Rank findings by estimated egress impact:
For each query identified in Step 1, or for each database query in the codebase if no stats are available, check:
Apply the appropriate fix for each problem found. Below are the most common egress anti-patterns and how to fix them.
Problem: The query fetches all columns but the application only uses a few. Large columns (JSONB blobs, TEXT fields) get transferred over the wire and discarded.
Fix: Name only the columns the response needs.
Before:
After:
Problem: A list endpoint returns all rows with no LIMIT. This is an unbounded egress risk — every new row in the table increases data transfer on every request. Flag this regardless of current table size.
This is easy to miss because the application may work fine with small datasets. But at scale, an unpaginated endpoint returning 10,000 rows with even moderate column widths can transfer hundreds of megabytes per day.
Fix: Bound the result set with ORDER BY plus LIMIT/OFFSET.
Before:
After:
When adding pagination, check whether the consuming client already supports paginated responses. If not, pick sensible defaults and document the pagination parameters in the API.
Problem: A query is called thousands of times per day but returns data that rarely changes. Every call transfers the same rows from the database. This pattern is only visible from pg_stat_statements — the code itself looks normal.
Look for queries with extremely high call counts relative to other queries. Common examples: configuration tables, category lists, feature flags, user role definitions.
Fix: Add a caching layer between the application and the database so it avoids hitting the database on every request.
Problem: The application fetches all rows from a table and then computes aggregates (averages, counts, sums, groupings) in application code. The full dataset transfers over the wire even though the result is a small summary.
Fix: Push the aggregation into SQL.
Before: The application fetches entire tables and aggregates in code with loops or .reduce().
After:
Problem: A JOIN between a wide parent table and a child table duplicates all parent columns across every child row. If a product has 200 reviews and the product row includes a 50KB JSONB column, the join sends that 50KB × 200 = ~10MB for a single request.
This is distinct from the SELECT * problem. Even if you select only needed columns, a JOIN still repeats the parent data for every child row. The fix is structural: avoid the join entirely.
Fix: Split the join into two queries, one per table.
Before:
After (two separate queries):
Two queries instead of one JOIN. The product data is fetched once. The reviews are fetched once. No duplication.
After applying fixes:
Get started with chainctlchainctl skill install public/neondatabase/neon-postgres-egress-optimizer:latest
Bring Chainguard's hardening pipeline to your first-party skills — custom rulesets, automated remediation, full audit trail.
skills.cgr.dev/public/github.com/neondatabase/skills/neon-postgres-egress-optimizer:latest
Apache-2.0
HARDENING.md
LICENSE
SKILL.md