codex deleted my database

Title: Critical safety failure: Codex ran destructive test setup against production database

Severity: Critical - production data loss

Summary:
Codex executed a test file from a production deployment directory. The test setup invoked
Base.metadata.drop_all(engine). Because the environment loaded the production database
configuration, the command connected to the production PostgreSQL instance and dropped
and recreated tables.

Expected behavior:
Codex must not run tests with destructive database setup against a production-configured
environment. It should detect production connection settings and refuse, require explicit
confirmation, or enforce an isolated temporary test database.

Actual behavior:
The destructive test was run without such protection, causing production tables to be
emptied/recreated.

Reproduction condition:
A test fixture uses SQLAlchemy Base.metadata.drop_all(engine), and the process inherits
a deployment .env containing production database settings.

Impact:
Production service data became unavailable. Services were stopped immediately and data
recovery is in progress.

Requested remediation:

1. Guardrails preventing destructive test commands when production database settings are detected.
2. Explicit approval before executing schema-drop operations outside isolated test environments.
3. Clearer command-level warning showing the resolved database target before destructive actions.

Start with the test file and fixture that invoke Base.metadata.drop_all(engine), then inspect how the deployment .env supplies the database configuration. Reproduce only against an isolated temporary database and trace how the resolved PostgreSQL target reaches the test command. Done means destructive setup is blocked or explicitly approved for production-configured environments, with a clear target warning.