A staging task that reached production started with a token in the wrong file

When a job meant for staging accidentally reaches production, the common response is "why did the job do that?" However, a more insightful question might be "why was it able to reach production?" Often, the answer is unremarkable. A production token ended up in a file that the job had no business reading.

Imagine a team creating an internal workflow to draft weekly support ticket summaries for human review. The task operates in a staging environment using a copy of the data. The task reads a configuration folder to determine the staging database address. In the same folder, an old .env.backup file remains, containing a production token from a migration months prior.

The task doesn't deliberately seek out credentials, it simply loads every file in the folder. Regrettably, one of those files contains a credential that grants access.

The task's instructions clearly state "staging," but instructions alone don't define boundaries. Access does. If a staging task can reach production credentials, then the environment split is merely a label and not a control. Fixing a single task won't solve the issue; the next task that reads the same folder will have the same reach.

Validate each bounded workflow individually by examining the folders it can read for unauthorized credentials, including backups, old exports, and sample configurations. Assign the staging job its own credentials that are valid only in staging to ensure production calls fail. Maintain the first version as read-only, directing output to a draft that a person can approve.

Document what the workflow can read, what it can write, and who reviews the output in a concise page. Anyone unfamiliar with the workflow should be able to read this page and identify any discrepancies. Test this configuration by running the staging job with a production-looking URL and observe what stops it. If nothing hinders it, you've discovered a critical oversight without incurring substantial costs.

These measures are not restricted to regulated environments; non-regulated internal work also carries privacy and security responsibilities. A stray token can easily overlook these obligations. Whether using MCP or not, the folder and the token should be the focal points. The goal is straightforward: a staging task should fail immediately when attempting to interact with production, as nothing it holds will function there.