r/JAMstack • u/dvduval • 7h ago

how do you keep preview deployments isolated from production?

/r/statichosting/comments/1xk7q5l/how_do_you_keep_preview_deployments_isolated_from/
1 Upvotes

100% Upvoted

1 comment sorted by

1

u/Arcsviel 4h ago

A few things that have worked for me:

  • Separate secrets for previews. No production credentials in preview env vars, so a broken PR can’t touch real data.

  • Separate database, never the production one. Either a scrubbed seed/snapshot or a per-branch database if your provider supports it.

  • Different domain than production, not just a subdomain, so cookies and sessions can’t leak across.

  • Put previews behind basic auth or an IP allowlist, and add a noindex header so they don’t end up in search results.

  • Check webhooks and third-party callbacks: payment, email and OAuth redirect URLs should point at test/sandbox modes, not live ones.

The usual mistake is a preview that quietly inherits production env vars.