On: My $500M Mars rover mistake

[csomar]

This is bad because if someone forgot to add prod or for whatever reason the code executed beyond the panic, you’ll wipe out the db.

There is no code that will protect your db/data. Only replication to a read-only storage will help in such situations.

[saagarjha → csomar]

If code is executing past a panic, I think it is unlikely that you can trust the integrity of your database anyways.

[Andrex → csomar]

But what if you have a chron job that auto replicates and then deletes everything after you forward it?