14.41Example safety guard

Your test setup could call:

GET /environment

and require:

{
  "environment": "QA"
}

before destructive tests start.

Or query Salesforce organization metadata and verify expected org identity.

Don't rely solely on a URL naming convention.