Detected from APP_URL, DATABASE_URL and REQUEST_HOST. Treat sign-in, emails, and workflow actions as non-production.