I think one thing is to make sure that when your test suite executes - you should force environment to "TEST" programmatically, before any bootstrapping code even runs.

So even if you allow for connection to production (sometimes that's allowed for debugging hard-to-reproduce issues), you want to remove any room for human error.

And your code should obviously NEVER be able to connect to anything other than the local test DB when your environment is set to "TEST".

Not letting devs access production :)