+1 to the request to restrict access to deploy previews from the public Internet
Another idea might involve letting devs hide/unhide deploy previews automatically based on their site’s config. It’d be nice to have a preview hide after its PR merges, but then still have the option to unhide it selectively if needed (i.e. to share with a customer, etc.).