@@ -198,7 +198,7 @@ production functions and real generated entries rather than copied code.
 - **Workers AI has no local emulator.** For a saved direct Cloudflare destination, `shouldBindWorkersAi()` injects the owner's remote AI binding during development and preview, using the same Cloudflare credentials as the CLI. Production builds use the normal AI binding. The root `ai.binding` takes precedence over `inference.bindings.ai`, with `AI` as the default name; `__VOID_AI_BINDING` records a custom runtime name. Managed and unsaved projects keep the Void proxy path during development. Apps without inferred AI usage must perform no AI authentication or entitlement probe.
 - **`mergeBindings` may remove a generated Cloudflare entry only under the name Void itself writes, gated on the matching `needs*` flag.** The Cloudflare plugin `defu`-merges the returned patch over `resolved` (arrays concatenate, `undefined` is skipped), so the only way to drop a key is to mutate `resolved` — and a mutation there is a change to the user's own config, which the CF-plugin-API rule above says takes precedence. The `send_email` serve-strip once deleted the whole field, so an app that drove Cloudflare's email API through its own `send_email: [{ name: "MAILER" }]` without ever importing `void/email` started `void dev` with `env.MAILER` undefined. It now filters out only the reserved `SEND_EMAIL` entry (`SEND_EMAIL_BINDING` from `cli/email-cloudflare.ts`, the name `void deploy --platform cloudflare` writes and the runtime reads), only when `bindings.needsEmail` — the same signal that arms the dev inbox — and drops the key only when nothing is left. `test/unit/plugin-email-config.test.ts` runs the real closure through a mocked `cloudflare()`.
 - **Every `/__void/inbox` route requires the dev-trigger token; the worker's capture POST carries it via a var.** Vite's host validation (`server.allowedHosts`, runs before plugin middlewares) only rejects DNS-rebinding hostnames — any IP-literal `Host` passes — and its default CORS reflects every `localhost` origin, so an unauthenticated inbox middleware hands every peer under `--host` (and every other local dev server) the raw MIME with Bcc and attachments, a DELETE, and a capture endpoint to plant messages. `plugin-email-dev-inbox.ts` therefore checks the same per-project token the cron/queue dev routes and the pages dev-CSS loopback use (`getOrCreateDevTriggerToken`, `.void/dev-trigger-token`), accepted as the `x-void-dev-trigger` header (worker, curl) or `?token=` (browser — the plugin prints the tokenized URL on `listening` and renders its own links with it; responses already send `Referrer-Policy: no-referrer`). Missing or wrong → `401` with a one-line body naming both forms and no ack header. The compiled router embeds the token as a module-local const that `runtime/email.ts` cannot import, so `mergeBindings` injects `__VOID_EMAIL_DEV_INBOX_TOKEN` next to `__VOID_EMAIL_DEV_INBOX` under the one `shouldInjectEmailDevInboxVar` gate (dev only — never in a build's `wrangler.json`); `sendEmail` sends it and, on a non-2xx, echoes the first line of the dev server's body so a missing token is diagnosable. Nothing on the worker side ever skips the inbox for a real transport because the token is absent. Because that file is now the inbox's whole credential and loopback needs no `--host`, `getOrCreateDevTriggerToken` creates it `0600` (`openSync(.., 'wx', 0o600)`) and best-effort `chmod`s a pre-existing file whose group/other bits are set, never rotating it (skipped on Windows, which has no such bits) — a default-umask `0644` file would hand every other account on a shared host the raw MIME, the DELETE, and the capture endpoint. `.void/dev-triggers.ts` (`plugin-framework-triggers.ts`) embeds the same token for Class A frameworks and is written `0600` the same way. `/__void/ping` stays open: it exposes no data. `/__void/restart` answers `403` unless the POST is same-origin (`Sec-Fetch-Site`, else `Origin`) and carries this server instance's random token in `x-void-restart` — browsers send no Fetch Metadata to plain-HTTP LAN origins (`--host`), so the token, embedded only in the `virtual:void/binding-hint` toast (which navigates with `&t=`; Vite's default CORS exposes it to localhost origins only, like the HMR token), is what stops a foreign page from opening `/__void/restarting` and riding its auto-POST. `/__void/restarting` refuses a navigation whose `Sec-Fetch-Site` is not `same-origin` or `none`, sends `Referrer-Policy: no-referrer`, and only navigates to a same-origin path from `?return=`, falling back to `/`.
-- **The dev server never serves the dev-trigger token.** Vite serves any root file not in `server.fs.deny`, and its CORS lets every localhost origin read the reply. `devTriggerSecretGuardPlugin` (`plugin-dev-config.ts`, registered in every serve plugin list) therefore answers 404 to `.void/dev-trigger*`, to Nitro dev bundles (`.nuxt/dev/`, `.nitro/dev/`, which inline the dispatch) and to Astro's `.astro/dev.log` (background `astro dev` output, which includes the startup hint) in any URL form, and `void:routing` refuses `virtual:void-routes` in the client environment. Do not switch to `server.fs.deny`: a plugin's list replaces Vite's defaults, and denying `.void/dev-triggers.ts` breaks the worker import.
+- **The dev server never serves the dev-trigger token or old database URLs.** Vite serves any root file not in `server.fs.deny`, and its CORS lets every localhost origin read the reply. `devTriggerSecretGuardPlugin` (`plugin-dev-config.ts`, registered in every serve plugin list) therefore answers 404 to `.void/dev-trigger*`, to Nitro dev bundles (`.nuxt/dev/`, `.nitro/dev/`, which inline the dispatch), to Astro's `.astro/dev.log` (background `astro dev` output, which includes the startup hint) and to `.void/drizzle.config.json` (older CLI versions left `db push` / `db studio` database URLs there; only drizzle-kit reads it) in any URL form, and `void:routing` refuses `virtual:void-routes` in the client environment. Do not switch to `server.fs.deny`: a plugin's list replaces Vite's defaults, and denying `.void/dev-triggers.ts` breaks the worker import.
 
 - **Sandbox SDK 1.0**: Keep the packaged Dockerfile helper version and the managed controller’s verified helper-layer digest in sync with `@cloudflare/sandbox`. Native execution uses Durable Object scheduling with named images; managed controller protocol 2 preserves admission, metering, and cleanup, including retained protocol 1 deployments. Cancellation crosses Workers RPC as a stream, not an AbortSignal. Run the Sandbox RPC and lifecycle tests when changing this boundary.
 
 
@@ -120,12 +120,13 @@ export function getOrCreateDevTriggerToken(root: string): string {
 // the generated `.void/dev-triggers.ts`, Nitro's dev bundle (`.nuxt/dev/` for
 // Nuxt, `dist/.nitro/dev/` for Analog), which inlines that module, and Astro's
 // `.astro/dev.log`, which records the startup hint when `astro dev` runs in the
-// background (`--background`, or started by a coding agent). Matched anywhere
-// in the decoded, lower-cased path so `/@fs/<abs>/`, `/@id/`, a base such as
-// `/_nuxt/`, case-insensitive file systems, dot segments, `//`, `%2e`, `\` and
-// Windows trailing dots/spaces all hit.
+// background (`--background`, or started by a coding agent). Also
+// `.void/drizzle.config.json`, where older CLI versions wrote database URLs.
+// Matched anywhere in the decoded, lower-cased path so `/@fs/<abs>/`, `/@id/`,
+// a base such as `/_nuxt/`, case-insensitive file systems, dot segments, `//`,
+// `%2e`, `\` and Windows trailing dots/spaces all hit.
 const DEV_TRIGGER_SECRET_PATH_RE =
-  /(?:^|\/)\.void[. ]*\/(?:.*\/)?dev-trigger|(?:^|\/)\.(?:nuxt|nitro)[. ]*\/(?:.*\/)?dev\/|(?:^|\/)\.astro[. ]*\/(?:.*\/)?dev\.log/;
+  /(?:^|\/)\.void[. ]*\/(?:.*\/)?(?:dev-trigger|drizzle\.config\.json)|(?:^|\/)\.(?:nuxt|nitro)[. ]*\/(?:.*\/)?dev\/|(?:^|\/)\.astro[. ]*\/(?:.*\/)?dev\.log/;
 
 export function isDevTriggerSecretRequest(url: string | undefined): boolean {
   if (!url) {
@@ -149,8 +150,8 @@ export function isDevTriggerSecretRequest(url: string | undefined): boolean {
 
 /**
  * Vite serves every root file that `server.fs.deny` does not list, and its default
- * CORS lets any localhost origin read the reply, so the files above would hand the
- * token to `--host` peers, other local accounts and other local dev servers.
+ * CORS lets any localhost origin read the reply, so the files above would hand their
+ * secrets to `--host` peers, other local accounts and other local dev servers.
  * `server.fs.deny` is not used: a plugin's list replaces Vite's defaults, and the
  * Cloudflare worker environment applies the same check when it imports
  * `.void/dev-triggers.ts`. The middleware is added in configureServer, so it runs
 
@@ -8,6 +8,7 @@ import { afterAll, beforeAll, describe, expect, it } from 'vite-plus/test';
 import { devTriggerSecretGuardPlugin } from '../../src/plugin-dev-config.ts';
 
 const TOKEN = 'dev-trigger-secret-0f3c9a';
+const DATABASE_URL = 'postgresql://app:db-secret-7e21b4@db.example.com/app';
 
 // node:http sends the path exactly as written; fetch would normalize dot segments.
 function get(port: number, path: string): Promise<{ status: number; body: string }> {
@@ -40,6 +41,11 @@ describe('dev server with the dev-trigger secret guard', () => {
     // Astro writes its background dev server output, startup hint included, here.
     mkdirSync(join(root, '.astro'), { recursive: true });
     writeFileSync(join(root, '.astro', 'dev.log'), `x-void-dev-trigger: ${TOKEN}\n`);
+    // Older CLI versions left the database URL of `void db push` / `db studio` here.
+    writeFileSync(
+      join(root, '.void', 'drizzle.config.json'),
+      JSON.stringify({ dialect: 'postgresql', dbCredentials: { url: DATABASE_URL } }),
+    );
 
     server = await createServer({
       root,
@@ -84,6 +90,12 @@ describe('dev server with the dev-trigger secret guard', () => {
     expect(response.body).not.toContain(TOKEN);
   });
 
+  it('does not serve a database URL left in .void/drizzle.config.json', async () => {
+    const response = await get(port, '/.void/drizzle.config.json');
+    expect(response.status).toBe(404);
+    expect(response.body).not.toContain('db-secret-7e21b4');
+  });
+
   it('still serves other files under .void', async () => {
     const response = await get(port, '/.void/routes.d.ts');
     expect(response.status).toBe(200);
 
@@ -31,6 +31,11 @@ describe('isDevTriggerSecretRequest', () => {
     '/.astro/dev.log',
     '/.ASTRO/Dev.Log?raw',
     '/@fs/Users/me/app/.astro/dev.log',
+    '/.void/drizzle.config.json',
+    '/.VOID/Drizzle.Config.json',
+    '/%2evoid/drizzle.config.json',
+    '/@fs/Users/me/app/.void/drizzle.config.json',
+    '/.void/drizzle.config.json?raw',
   ])('refuses %s', (url) => {
     expect(isDevTriggerSecretRequest(url)).toBe(true);
   });
@@ -52,6 +57,8 @@ describe('isDevTriggerSecretRequest', () => {
     '/dist/.nitro/types/nitro.d.ts',
     '/.astro/dev.json',
     '/.astro/content.d.ts',
+    '/drizzle.config.json',
+    '/.void/drizzle.config.ts',
     '/?q=/.void/dev-trigger-token',
     '/@vite/client',
   ])('allows %s', (url) => {