Never text or push customers from test systems

How to do it

Staging can hold customer phone numbers and push tokens by mistake, and one test job can wake thousands of phones. Give production the only live provider credentials. Use the provider's test credentials or a local fake sender everywhere else. Keep a short allow list of team test numbers and device tokens. The same rule for email is never email customers from test systems.

Example

const TEST_RECIPIENTS = new Set(['+46700000001', 'device-token-test-1']);

export function allowedRecipient(environment, recipient) {
  return environment === 'production' || TEST_RECIPIENTS.has(recipient);
}

TEST_RECIPIENTS = {"+46700000001", "device-token-test-1"}

def allowed_recipient(environment: str, recipient: str) -> bool:
    return environment == "production" or recipient in TEST_RECIPIENTS

How to check

A test starts the app with staging settings and sends a text to +46701234567 and a push to an unknown token. Neither reaches the provider. The staging environment holds no live provider key.