A while ago I was chasing a bug that only happened in production. Renewal emails weren't going out, and a flag that should have been set on users after renewal simply wasn't.

I couldn't reproduce it locally with seeded data, so I did what a lot of us do: I cloned the production database to my machine, ran the queued jobs by hand, and sprinkled logs through the code to see where things went wrong.

Writing to that clone was fine. It's a copy, I wanted the jobs to set the flag so I could see what happened. What wasn't fine was the feeling in my stomach every time I ran a job:

What if this actually sends a renewal email to a real customer?

The clone had real email addresses in it. My local .env had a working mail driver. One wrong config and a real person gets an email about a subscription from my laptop.…