Not a setting — a different connection
A toggle can be switched, by mistake or by a bug. Cartsella Studio's clones and syncs are given a connection to your live store that is only able to send read requests to Shopify — it has no way to run a mutation at all. A bug in a clone can produce a broken staging record, but it can't turn into a write to your live store, because the code path that reads Production was never handed the ability to write.
The one opt-in exception
Editing a store's own product fields — the Metafields page, and moving fields from staging to your live store — is different: it acts on whichever store the app is open in, including your live store, because that's the point of the feature. It uses a separate connection that can only send metafield and content-entry changes, never anything else, and only once you open that page and confirm a change. It's opt-in, scoped, and every change it makes is recorded.
What this buys you
A mistake in a clone's mapping logic, a timeout mid-batch, a malformed record from an old app — none of it can reach your live store as a write, because the connection used to read it doesn't have that capability. The worst a clone can do to Production is fail to finish reading it.
One reads your live store and can never write to it. The other, used only for product fields, can write but only there, only to fields, and only when you confirm it.
See the rest of the rules we build around.
Join the waitlist: 50% off your first yearRead next: How Cartsella Studio keeps your live store safe · Every write, recorded