Deploy

Keep previews away from production data

Point previews at a separate database with test keys and turn on Vercel Deployment Protection where previews shouldn't be public.

Why it matters

Preview URLs are easy to find and share. If they use the production database and keys, an unfinished branch can corrupt or expose real data.

How to fix it

1. Give the Preview environment its own database (a Supabase branch or a separate project) and test keys.
2. Turn on Vercel Deployment Protection for previews that shouldn't be public.
3. Don't seed previews with copies of real user data.

How to verify

• Open a preview URL in a private window: either it asks you to sign in, or it shows only test data.

Related checks

• Set Vercel environment variables per environment
• Keep Stripe test and live keys apart
• Have backups and test a restore

Tick it off in the full checklist