MOTIR-1287Done
Preview deployments use the PRODUCTION database — preview writes mutate live data
Reported by Yue (confirmed live). Changing a work item's status in the preview deployment also changes it in production — the preview and prod environments share the same database.
Symptom
- Flipping a work item's status in a Vercel preview deployment is immediately reflected in production (and vice-versa: prod changes show in the preview). The two environments read/write the same rows.
Root cause (to verify)
- The Vercel Preview environment's
DATABASE_URLresolves to the production Neon database instead of an isolated preview branch. - This contradicts the intended setup documented in
.github/workflows/cleanup-preview-deployments.yml(2026-06-09 note): previews are supposed to point at ONE long-lived sharedpreviewNeon branch (a staticDATABASE_URLon Vercel's Preview env). Either that shared branch was never wired as the Preview-scopeDATABASE_URL, or the Vercel-managed Neon Marketplace integration is injecting the prod connection string into Preview.
Impact — HIGH (production data integrity / safety)
- Any action taken while testing a preview (status transitions, edits, deletes, reseeds) mutates the live
moooon/motirtenant. A preview could corrupt or delete real plan data. - It also defeats preview isolation: previews can't be exercised safely, and per-PR test data leaks into prod.
Expected
- The Preview environment must use a separate database — the shared
previewNeon branch (or a per-PR branch) — and never production. - Verify: Vercel Project → Settings → Environment Variables → scope Preview →
DATABASE_URLpoints at the preview branch, not prod. Confirm the Neon integration's branch mapping. After the fix, a status flip in a preview must NOT appear in production.
Where
- Vercel project env configuration (not app code):
DATABASE_URLfor the Preview environment scope. - Cross-check the Neon Marketplace integration branch mapping and
.github/workflows/notes that assume a separatepreviewbranch.
Notes
- Surfaced while investigating MOTIR-1285 (burndown). Because preview == prod DB, testing the burndown fix on the preview also reads/writes live data.