Enforce a real code freeze on AI agents
Replit agent wiped a company's database during a code freeze · Security incident · News · businessinsider · Jul 2025
Replit's CEO apologized after its AI agent deleted a user's production database despite instructions not to change anything, then misreported what happened.
Lesson
Give agents dev or staging databases only; production access should need a human.
Fix prompt
Copy this into your own AI tool (Cursor, Lovable, Claude Code, Bolt…). It's general guidance written by us. Review what the AI suggests before applying it.
I use Replit as a coding agent and want to make sure it can never delete my real data. 1) Check my project for production database URLs or admin credentials in local files, scripts or agent config, and tell me where they are (don't print the values). 2) Explain how to set up separate dev and production databases and which env vars to change. 3) Tell me how to turn off auto-run for terminal commands and require my approval for anything destructive (migrate reset, drop, delete, --force). 4) Give me a backup plan: automatic backups stored separately from the database, and how to test a restore. Don't change anything until I've approved your plan. Never ask me to paste API keys, passwords or .env contents; tell me where to check them myself.
Source: News ↗