Group
  • Testing

    Get real user data out of my test and staging environments

    Finds production data copied into test fixtures and staging databases and replaces it with safe synthetic data.

    • Improve quality
    • Plan & validate
    • Intermediate
    • General

Free Prompt

Audit my test and staging environments for real user data and replace it with synthetic data. 1. Find the leaks: check test fixtures and seed files for real names, emails, phone numbers, or content copied from production, staging databases that were populated from a production dump, screenshots or exports in the repo that contain user data, and any developer-local scripts that pull production data down. 2. Assess sensitivity: for anything found, note what it contains (emails only, or names, addresses, payment-adjacent data, private user content) so I know how careful deletion needs to be. 3. Replace with synthetic: build a proper fake data generator for fixtures and seeds (Faker or equivalent) producing realistic but clearly synthetic records. Use obviously-fake domains for emails (example.com or a test domain I own) so a misconfigured email job can never message a real person. 4. Staging policy: going forward, staging gets synthetic or anonymized data only. If I genuinely need production-shaped data in staging, write an anonymization script that scrubs emails, names, and free-text fields before import, and document that the anonymized copy is the only allowed path. 5. Clean history: if real data was committed to the repo, flag that it lives in git history and give me the steps to purge it (filter-repo or equivalent) plus credential rotation if any secrets rode along. Do not just delete rows and move on; if real user data sat in a shared staging environment, tell me who had access so I can judge exposure. Give me: what was found and where, the synthetic data generator, the anonymization script for staging, and the git history purge steps if needed.

What This Does / How This Helps

Finds production user data sitting in your tests and staging, replaces it with synthetic data, and sets the policy that keeps it out. Copying the production database to staging is the move everyone makes once. Then the staging site has no rate limiting, a debug toolbar on, and every customer's email address, and it is one forgotten environment variable away from emailing all of them a test message. Test fixtures get committed to the repo and now user data is in git history forever. The prompt inventories the exposure, builds realistic synthetic fixtures, writes an anonymization path for when you truly need production-shaped data, and handles the git history cleanup if the damage is already done.

Want to skip doing this by hand?

Fortivibe audits your app for all of the areas these prompts cover (and more).

See What We Check

Related Prompts