Marked as helpful by the asker
The URL contains your database password. Treat it like the password. Give Cursor the schema (\d+) and error messages, never the credentials. If you already pasted it once, rotate the database password today; it's one click in the Supabase dashboard.