# Ensure pull request previews are disabled for sensitive services

- Source: https://support.icompaas.com/support/solutions/articles/a_1793876664234675-ensure-pull-request-previews-are-disabled-for-sensitive-services
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Render Cloud](https://support.icompaas.com/support/solutions/c_1793875953948152) › [Checks](https://support.icompaas.com/support/solutions/folders/f_1793875960840493)
- Last updated: 2026-11-05
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure pull request previews are turned off for services that handle sensitive data. A pull request preview is a separate copy of the service, created for each pull request, with its own public URL and often the same environment variables as the main service.

**Rationale**

Preview instances are publicly reachable and may run unreviewed code with access to real secrets and data. This can expose sensitive information or give an attacker a way in through a pull request. Turning previews off for sensitive services removes these extra public copies.

**Impact**

-   No extra public copies of sensitive services are created
    
-   Reduces the risk of exposing secrets through previews
    
-   Reviewers lose live previews for these services
    

**Default Value**

Pull request previews are off unless they are enabled in the service's Previews tab or in render.yaml.

**Pre-Requisites**

-   Admin or Developer role on the service
    
-   A list of services that handle sensitive data
    

**Remediation**

**Test Plan**

1.  Sign in to the Render Dashboard at [https://dashboard.render.com](https://dashboard.render.com/).
    
2.  From your workspace home (or project), click the service to open it.
    
3.  Open the Previews tab and check the Pull Request Previews setting.
    
4.  If it is Manual or Automatic for a sensitive service, follow the implementation steps.
    

**Implementation Steps**

1.  Sign in to the Render Dashboard at [https://dashboard.render.com](https://dashboard.render.com/).
    
2.  From your workspace home (or project), click the service to open it.
    
3.  Open the Previews tab and set Pull Request Previews to Off.
    
4.  Delete any active preview instances from their Settings tab.
    
5.  If the service is managed by a Blueprint, remove the previews setting (or set previews.generation to off) in render.yaml.
    

**Backout Plan**

1.  Sign in to the Render Dashboard at [https://dashboard.render.com](https://dashboard.render.com/).
    
2.  From your workspace home (or project), click the service to open it.
    
3.  Open the Previews tab and set Pull Request Previews back to Manual or Automatic.
    

**Reference**

-   [https://render.com/docs/service-previews](https://render.com/docs/service-previews)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.