Email is kind of hard. There’s usually only one API key to the email client, and there’s no real safe way to call it. Personally over the years my approach is to have an internal library that reads what environment it is in, and then if it doesn’t explicitly tell that it’s in prod, it reroutes everything to safe email addresses.
I have a " no drag racing" sign near my home. It doesn’t seem to have had the effect they hoped for