howto/puppet: additional advice about environments

cf. team#41991

howto/puppet.md

@@ -149,6 +149,13 @@ on the puppet server. By assigning a node to the test environment via the
 small set) can be made to apply test puppet code. Once the feature branch is
 satisfying, it can be then simply merged to `main` and deleted.
 
+Because environments aren't totally isolated from each other and a compromised
+node could choose to apply an environment other than `production`, care should
+be taken with the code pushed to these feature branches. It's recommended to
+avoid overly broad debugging statements, if any, and to generally keep an
+active eye on feature branches so as to prevent the accumulation of unreviewed
+code.
+
 ### Modifying an existing configuration
 
 For new deployments, this is *NOT* the preferred method. For example,