A colleague opened our staging admin tool to check something unrelated and found a real customer's order in it, placed forty minutes earlier, with a real card reference on it. For nineteen days about a third of our checkout writes had gone into the staging database. Three weeks before, an engineer had needed to reproduce a bug against staging data. He copied the checkout manifest, renamed the Deployment to checkout-debug, pointed it at the staging config map, and applied it in the production ...