René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"Security issue - create @tanstack/start with neon db exposes database url to client","articleBody":"### Which project does this relate to?\n\nCreate Tanstack App\n\n### Describe the bug\n\nCreating a new tanstack start project with `pnpm create @tanstack/start@latest` per the docs will generate a project with the environment variables for the database prefixed with `VITE_` -- this means that they are sent to the client.\n\nBeing new to vite I had no idea this was the case. Luckily my app is not to production yet, but I'd expect a lot of people might overlook this when building a new app with this tool.\n\n### Your Example Website or App\n\nhttps://tanstack.com/start/latest/docs/framework/react/quick-start\n\n### Steps to Reproduce the Bug or Issue\n\n1. Follow the quick start instructions\n2. Expose your DB variables to the client\n\n### Expected behavior\n\nDo not expose sensitive variables to the client\n\n### Screenshots or Videos\n\n_No response_\n\n### Platform\n\nAny\n\n### Additional context\n\n_No response_","author":{"url":"https://github.com/billy-the-ape","@type":"Person","name":"billy-the-ape"},"datePublished":"2026-01-12T20:45:12Z","url":"https://github.com/TanStack/cli/issues/287"}