-- Security fixes for CI / hosting (docs/security-triage/2026-10-audit/ci-hosting.md). -- CI-A3: site variables are production-only unless explicitly marked for previews. Preview deployments created by -- non-admins only receive preview variables when a repo admin opted the site in (`sites.preview_env`). ALTER TABLE site_env ADD COLUMN preview INTEGER NOT NULL DEFAULT 0; ALTER TABLE sites ADD COLUMN preview_env INTEGER NOT NULL DEFAULT 0; ALTER TABLE site_deployments ADD COLUMN creator_admin INTEGER NOT NULL DEFAULT 0;