How to preview WIP changes before they go public — using just branches, one repo, and a free Cloudflare feature most beginners miss.
Every running app or website exists in three slightly different versions, all the time:
localhost:3000What you're actively editing. Lives on your Mac, runs only when you start it, dies when you close the tab.
dev.your-siteA deployed version of "what's next." Lives on a real URL. Only you (and Josh) see it. Lets you click around like a real user before going live.
your-site.comThe public, polished version. Updated only when you've tested staging and you're sure.
Most beginners think these need to be three different repos or three different servers. They don't. They can all live in one repo, one Cloudflare Pages project, one Coolify app — distinguished only by which branch they correspond to.
Remember from Lesson 1: a branch is just a sticky note pointing at a commit. Cloudflare Pages reads that sticky note to decide what to deploy where:
Same repo. Three sticky notes. Three different deploy URLs. Whichever sticky note you move forward, the corresponding URL redeploys.
This is the unlock most beginners miss. When you push any non-main branch to GitHub, Cloudflare Pages automatically:
builds it · deploys it · gives it its own URL · DMs you the link
You did nothing to configure this. It just happens. The URL pattern is {branch-name}.{your-project}.pages.dev — slugified from the branch name.
1. Want to try an idea? git checkout -b try-new-scoreboard
2. Make changes, commit, push.
3. CF Pages sends you a URL ~30 seconds later: try-new-scoreboard.duck-hunt.pages.dev
4. Click around, share with Josh, decide if you love it.
5. Love it? Merge the branch into main. Production URL redeploys with the change.
6. Hate it? Delete the branch. The preview URL disappears. Zero cleanup.
The two-repos pattern (a private repo for dev, a public repo for prod, manually copying code between them) is a relic from before branch-based preview deploys existed. You'd have to sync changes between repos, manage permissions on both, deal with diverging histories. Every modern deploy platform (Pages, Vercel, Netlify) does branch-based previews for free. One repo is the modern answer.
You wondered: "should the public prod repo strip out CLAUDE.md, .claude/, plans/, ideas/? Stronger .gitignore?"
The instinct is good, but the worry is misplaced. There are two separate things here that are easy to conflate:
CF Pages deploys whatever is in your build output directory (you configure this in the Pages dashboard — usually dist/, public/, or the repo root for simple sites). Files outside that directory — including CLAUDE.md, .claude/, plans/ — are never served to visitors. Visitors couldn't reach them even if they tried, because no URL maps to them.
Keep CLAUDE.md, .claude/, plans/, ideas/ in your repo. They're not visitor-facing. Visitors only see the build output. Even on a fully public repo, having these files is fine — many indie devs explicitly ship their .claude/ setup publicly so others can clone the working pattern.
Secrets, always. .env, .mcp.json with credentials, any file with API keys or tokens. These belong in .gitignore + your deploy platform's environment variable system (CF Pages calls these "Environment Variables and Secrets" — set them in the dashboard, not in committed files).
For solo / small-team work, the public-vs-private question is usually overthought. Here's the actual decision rule:
Until you have a specific reason to make a repo public, leave it private. Costs nothing. Reduces "did I commit a secret?" anxiety. You can flip private→public later with one click; flipping back to private doesn't ungoogle the history.
You want others to fork it. You want to ship it as open source. You want potential employers to find it. You want easier sharing (no auth wall when sending a link). You want GitHub's free CI minutes (private repos have a smaller quota; public repos are unlimited).
Whether private or public, never commit secrets. Private just means the blast radius of an accidental commit is smaller (just you and your collaborators saw it, not the entire internet). It's still a leak — rotate the credential the moment you notice.