The frontend Sentry DSN was committed in wrangler.jsonc `vars`. Move it to a Wrangler secret (same pattern as SENTRY_DSN, DATABASE_URL, WORKOS_*) so it's not in source and persists across every deploy path (secrets are never deleted by deployments, regardless of --keep-vars). The client bundle continues to get the value at build time via Vite reading process.env.VITE_PUBLIC_SENTRY_DSN under `op run --env-file=.env.production`. One-time setup after deploying this change: op run --env-file=.env.production -- sh -c 'printf "%s" "$VITE_PUBLIC_SENTRY_DSN" | bunx wrangler secret put VITE_PUBLIC_SENTRY_DSN'
Showing the changes to apps/cloud/src (1 of 2 files). Show all
Unified · Split
| @@ -11,6 +11,7 @@ declare global { · 10 unmodified lines | |||
| 11 | AXIOM_TRACES_URL?: string; | 11 | AXIOM_TRACES_URL?: string; |
| 12 | AXIOM_TRACES_SAMPLE_RATIO?: string; | 12 | AXIOM_TRACES_SAMPLE_RATIO?: string; |
| 13 | SENTRY_DSN?: string; | 13 | SENTRY_DSN?: string; |
| 14 | VITE_PUBLIC_SENTRY_DSN?: string; | ||
| 14 | 15 | ||
| 15 | // Datastore (dev only — prod uses HYPERDRIVE binding) | 16 | // Datastore (dev only — prod uses HYPERDRIVE binding) |
| 16 | DATABASE_URL?: string; | 17 | DATABASE_URL?: string; |