Field Notes from a Sandbox That Was One Flag Away from Production

The sandbox shared credentials, endpoints, and one environment flag with production, and a copied config file was all it took for test traffic to act on real state.

The sandbox was production wearing a costume: same credentials, same endpoints, one boolean of difference. The costume slipped when someone copied a config file, as someone eventually would.

Structural separation now in place

• Sandbox credentials cannot authenticate against production endpoints.
• Environment identity is verified by the receiving side, not asserted by the caller.
• Destructive capabilities are absent from sandbox grants entirely.

Use the security docs, threat model, and architecture guide to make crossing environments impossible, not just discouraged.