---
title: "Keep production data and secrets out of · Agent Wranglers"
url: https://agentwranglers.se/playbook/infrastructure/hosting-platforms/preview-isolation
updated: 2026-10-21
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Keep production data and secrets out of previews

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Hosting platforms](https://agentwranglers.se/playbook/infrastructure/hosting-platforms.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers). Updated 2026-10-21.

- ID: INF-64
- Level: Required
- Chapter: [Hosting platforms](https://agentwranglers.se/playbook/infrastructure/hosting-platforms)
- Rule: Give preview deployments their own secrets and a database with made-up data. A preview build never sees a production key or connection string, and its address asks visitors to sign in.
- Risk: Data leaked or lost
- How: Many platforms build every branch with the same settings unless you give each environment its own variables. Some preview addresses even run against production resources. Cloudflare says a Version URL uses that version's existing configuration and resources. Code in a pull request can read every secret its build receives, so pull requests from forks get none. Preview addresses are often public, so put them behind the platform's sign-in or a password. Delete previews on time as [Delete preview environments on time](https://agentwranglers.se/playbook/infrastructure/environments/preview-environments) says. Keep them in a separate account as [Give each environment its own account](https://agentwranglers.se/playbook/infrastructure/environments/account-per-environment) says.
- Check: A CI job reads the preview variables through the platform's API and compares their hashes with production. No value matches. A request without sign-in to a preview address gets 401, 403 or a sign-in page.

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### JavaScript example

```js
import { createHash } from 'node:crypto';

const hash = value => createHash('sha256').update(value).digest('hex');

export function sharedSecretNames(previewVariables, productionVariables) {
  const productionHashes = new Set(Object.values(productionVariables).map(hash));
  return Object.entries(previewVariables)
    .filter(([, value]) => productionHashes.has(hash(value)))
    .map(([name]) => name);
}
```

### Python example

```python
import hashlib

def sha256(value: str) -> str:
    return hashlib.sha256(value.encode()).hexdigest()

def shared_secret_names(preview_variables: dict, production_variables: dict) -> list[str]:
    production_hashes = {sha256(value) for value in production_variables.values()}
    return [name for name, value in preview_variables.items() if sha256(value) in production_hashes]
```

## Sources

- [Cloudflare Workers version URLs](https://developers.cloudflare.com/workers/configuration/previews/)

## Related rules

- [Delete preview environments on time](https://agentwranglers.se/playbook/infrastructure/environments/preview-environments) in Infrastructure
- [Give each environment its own account](https://agentwranglers.se/playbook/infrastructure/environments/account-per-environment) in Infrastructure

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/infrastructure/hosting-platforms/preview-isolation">Agent Wranglers infrastructure playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Test the service against every platform limit](https://agentwranglers.se/playbook/infrastructure/hosting-platforms/platform-limits)
- Next: [Choose regions from users and data rules](https://agentwranglers.se/playbook/infrastructure/hosting-platforms/region-choice)
- [Hosting platforms](https://agentwranglers.se/playbook/infrastructure/hosting-platforms)