Keep agents away from your production database
Cursor ran a migrate reset on production and wiped the database · Reddit r/vibecoding · u/pankaj9296 · Oct 2025
With auto-run enabled, a reset command wiped the builder's production database. They recovered from a VM snapshot and then added staging, approvals, backups and monitoring.
Lesson
Turn off auto-run for terminal commands, keep production credentials out of your dev environment, and test restoring a backup.
Fix prompt
Copy this into your own AI tool (Cursor, Lovable, Claude Code, Bolt…). It's general guidance written by us. Review what the AI suggests before applying it.
I use Cursor as a coding agent and want to make sure it can never delete my real data. 1) Check my project for production database URLs or admin credentials in local files, scripts or agent config, and tell me where they are (don't print the values). 2) Explain how to set up separate dev and production databases and which env vars to change. 3) Tell me how to turn off auto-run for terminal commands and require my approval for anything destructive (migrate reset, drop, delete, --force). 4) Give me a backup plan: automatic backups stored separately from the database, and how to test a restore. Don't change anything until I've approved your plan. Never ask me to paste API keys, passwords or .env contents; tell me where to check them myself.
Source: Reddit r/vibecoding ↗