Test and seed data has been removed

Seed data in a production database creates concrete security vulnerabilities: test accounts with known credentials like test@example.com / password123 become valid login targets. CWE-798 (Use of Hard-coded Credentials) covers this class: any attacker who reads your seed script can authenticate to your production application as any seeded user. Beyond security, contaminated production data produces misleading analytics, corrupted user counts, and phantom records that break business logic assumptions — all problems that compound over time as real user data accumulates alongside test records.

Add a hard production guard to all seed scripts and audit the production database for test entries before launch.

// prisma/seed.ts
if (process.env.NODE_ENV === 'production') {
  console.error('Seed script must not run in production')
  process.exit(1)
}

Remove any package.json scripts that run seed on deploy (e.g., postinstall or vercel-build hooks that call prisma db seed). Query your production database directly for test entries: SELECT email FROM users WHERE email ILIKE '%test%' OR email ILIKE '%example%'. Revoke or delete any seeded API keys or OAuth tokens that exist in the production database.