Problem
The Neon integration gives every preview deployment its own database branch, so content edits in a preview are isolated. Media is not isolated. Vercel Blob is a single project-level store reached through one BLOB_READ_WRITE_TOKEN, so every preview shares the production media library.
The practical consequence: someone evaluating the CMS in a preview deployment can open the Media collection and delete an image, and that image disappears from the production demo that everyone else sees. Uploads land in the shared store too, so previews accumulate files that production then serves.
This makes a preview unsafe to hand to anyone who might reasonably click "delete" while trying the CMS out, which is the main thing previews are useful for.
Why it happens
- database: branched per preview by the Neon integration, isolated
- Blob: one store per Vercel project, one token, shared by every deployment including previews
Isolation is currently tested per platform rather than per store, so a database-isolation check passes while media remains shared.
Possible fixes
- A separate Blob store per preview, with a branch-scoped
BLOB_READ_WRITE_TOKEN. Cleanest isolation, but needs a store provisioned per preview and torn down with it
- A per-preview path prefix enforced in the upload adapter, with reads filtered to the same prefix. Cheaper, no extra provisioning, but it is isolation by convention, and a bug in the filter leaks across previews
- Read-only media in previews, disabling upload and delete when a preview environment is detected. Smallest change, but it removes a capability that is worth demonstrating
Option 1 is the only one that makes a preview genuinely safe to hand over. Option 2 is a reasonable interim if provisioning per preview is too costly.
Acceptance criteria
- deleting or uploading a media item in a preview deployment has no effect on production or on any other preview
- an isolation check covers the media store specifically, not only the database
- teardown of a preview also releases whatever media storage it allocated
Problem
The Neon integration gives every preview deployment its own database branch, so content edits in a preview are isolated. Media is not isolated. Vercel Blob is a single project-level store reached through one
BLOB_READ_WRITE_TOKEN, so every preview shares the production media library.The practical consequence: someone evaluating the CMS in a preview deployment can open the Media collection and delete an image, and that image disappears from the production demo that everyone else sees. Uploads land in the shared store too, so previews accumulate files that production then serves.
This makes a preview unsafe to hand to anyone who might reasonably click "delete" while trying the CMS out, which is the main thing previews are useful for.
Why it happens
Isolation is currently tested per platform rather than per store, so a database-isolation check passes while media remains shared.
Possible fixes
BLOB_READ_WRITE_TOKEN. Cleanest isolation, but needs a store provisioned per preview and torn down with itOption 1 is the only one that makes a preview genuinely safe to hand over. Option 2 is a reasonable interim if provisioning per preview is too costly.
Acceptance criteria