EF Core Design-Time Factories Can Silently Target Unintended Databases

A misconfigured EF Core design-time DbContext factory can successfully connect to a database that was never deliberately chosen, creating a hidden safety risk. Unlike a failed connection, an unintended successful one appears legitimate, masking the absence of conscious intent. This issue surfaced during a codebase cleanup where a factory was still falling back to configuration from a decoupled application host, crossing an architectural boundary that had already been separated at runtime. The recommended fix is to avoid broad configuration fallbacks and instead use an unmistakably unreachable sentinel connection string when no explicit target is configured. This separates offline model-inspection capabilities from live database access, ensuring any unintended connection attempt fails with a clear, recognisable error.