GATE014: Possible production environment access

Configuration contains indicators that this agent is pointed at a production system.

Name
Severity
Type
High
Description
Default severity. An individual finding may be reported higher or lower when the surrounding configuration justifies it.
Name
Capabilities
Type
admin
Description
Capability classes this rule reasons about.
Name
Explain locally
Type
gate explain GATE014
Description
The same text, in your terminal, with no network access.

What Gate detected

Gate found production indicators: a hostname, database name, environment variable, or credential prefix containing prod, production, prd, live, or a live-mode payment key, attached to a configured server. Gate reports this as possible production access: a repository can name a staging database prod-clone, and Gate cannot tell the difference from configuration alone.

Why this matters

Every other finding in a scan gets worse when the target is production. A destructive tool against a scratch database is a nuisance; the same tool against the production database is an incident with customers in it. Production access also tends to be the access nobody re-reviews, because it was granted during an outage and never taken back.

Example

This is the shape of configuration that triggers the rule.

{
  "mcpServers": {
    "postgres": {
      "command": "mcp-postgres",
      "env": { "DATABASE_URL": "${env:PROD_DATABASE_URL}" }
    }
  }
}

Remediation

Point local and CI agents at a non-production replica. Where production access is genuinely required, use a separate, short-lived, read-only credential and require human approval for write and delete operations.

Suppressing this rule

If this finding is acceptable in your repository, record why alongside the suppression:

gate.config.ts

export default defineConfig({
  ignore: [
    {
      rule: 'GATE014',
      reason: 'Why this is acceptable here',
    },
  ],
})

Gate refuses to apply an ignore entry with no reason. The reason is the only thing that will tell the next person whether the suppression is still true.