Staging task reached production after loading a stray production token from a config folder

A demo scenario describes an internal workflow that drafts weekly support ticket summaries and runs in staging against a copy of the data. The task read a config folder to find the staging database address, and that folder contained an old .env.backup file holding a production token from a months-old migration. Because the job loads every file in the folder, it used the working credential and a draft ended up in the wrong place or a lookup hit the live system. The author argues that instructions saying "staging" are not a real boundary, and that access controls must be what keeps environments separate. The piece recommends auditing readable folders for stray credentials, issuing staging-only credentials, keeping early versions read-only with human approval, and testing whether production-looking calls fail loudly.