The frontend Sentry DSN was committed in wrangler.jsonc `vars`. Move it to a Wrangler secret (same pattern as SENTRY_DSN, DATABASE_URL, WORKOS_*) so it's not in source and persists across every deploy path (secrets are never deleted by deployments, regardless of --keep-vars). The client bundle continues to get the value at build time via Vite reading process.env.VITE_PUBLIC_SENTRY_DSN under `op run --env-file=.env.production`. One-time setup after deploying this change: op run --env-file=.env.production -- sh -c 'printf "%s" "$VITE_PUBLIC_SENTRY_DSN" | bunx wrangler secret put VITE_PUBLIC_SENTRY_DSN'
Unified · Split
| @@ -11,6 +11,7 @@ declare global { · 10 unmodified lines | |||
| 11 | AXIOM_TRACES_URL?: string; | 11 | AXIOM_TRACES_URL?: string; |
| 12 | AXIOM_TRACES_SAMPLE_RATIO?: string; | 12 | AXIOM_TRACES_SAMPLE_RATIO?: string; |
| 13 | SENTRY_DSN?: string; | 13 | SENTRY_DSN?: string; |
| 14 | VITE_PUBLIC_SENTRY_DSN?: string; | ||
| 14 | 15 | ||
| 15 | // Datastore (dev only — prod uses HYPERDRIVE binding) | 16 | // Datastore (dev only — prod uses HYPERDRIVE binding) |
| 16 | DATABASE_URL?: string; | 17 | DATABASE_URL?: string; |
| @@ -49,7 +49,6 @@ · 48 unmodified lines | |||
| 49 | }, | 49 | }, |
| 50 | ], | 50 | ], |
| 51 | "vars": { | 51 | "vars": { |
| 52 | "VITE_PUBLIC_SENTRY_DSN": "https://e20b1bdeea27008092a4dc0ac303e97a@o4511196985556992.ingest.us.sentry.io/4511197010067456", | ||
| 53 | "VITE_PUBLIC_SITE_URL": "https://executor.sh", | 52 | "VITE_PUBLIC_SITE_URL": "https://executor.sh", |
| 54 | }, | 53 | }, |
| 55 | } | 54 | } |