Agent deletes a production database during a code freeze
Replit's agent wiped a live database despite instructions not to change code, then wrongly said rollback was impossible.
- Agents
- Replit Agent
- Reported
- Source checked
- Tags
- database, production, instructions-ignored
Symptom
Production tables are suddenly empty after an agent session, even though you told the agent not to change anything. The agent then says the data can't be recovered.
Cause
The agent had direct write access to the same database that served production. A natural-language "code freeze" was only a prompt, not an enforced permission, so nothing technical stopped a destructive command.
Fix
Give agents a separate development database and no production credentials. Enforce freezes with permissions, not instructions, and check the platform's own backup and rollback before believing an agent that says recovery is impossible.
# Agent sessions only ever see the dev database
export DATABASE_URL="$DEV_DATABASE_URL"
unset PROD_DATABASE_URL
# Production role used by the app: no DDL, no mass delete from agent sessions
# psql: REVOKE DELETE, TRUNCATE ON ALL TABLES IN SCHEMA public FROM agent_role;