Keep production data and secrets out of previews

How to do it

Many platforms build every branch with the same settings unless you give each environment its own variables. Some preview addresses even run against production resources. Cloudflare says a Version URL uses that version's existing configuration and resources. Code in a pull request can read every secret its build receives, so pull requests from forks get none. Preview addresses are often public, so put them behind the platform's sign-in or a password. Delete previews on time as Delete preview environments on time says. Keep them in a separate account as Give each environment its own account says.

Examples

JavaScript example

import { createHash } from 'node:crypto';

const hash = value => createHash('sha256').update(value).digest('hex');

export function sharedSecretNames(previewVariables, productionVariables) {
  const productionHashes = new Set(Object.values(productionVariables).map(hash));
  return Object.entries(previewVariables)
    .filter(([, value]) => productionHashes.has(hash(value)))
    .map(([name]) => name);
}

Python example

import hashlib

def sha256(value: str) -> str:
    return hashlib.sha256(value.encode()).hexdigest()

def shared_secret_names(preview_variables: dict, production_variables: dict) -> list[str]:
    production_hashes = {sha256(value) for value in production_variables.values()}
    return [name for name, value in preview_variables.items() if sha256(value) in production_hashes]

How to check

A CI job reads the preview variables through the platform's API and compares their hashes with production. No value matches. A request without sign-in to a preview address gets 401, 403 or a sign-in page.

Sources

• Cloudflare Workers version URLs

Related rules

• Delete preview environments on time in Infrastructure
• Give each environment its own account in Infrastructure