Every risky feature needs an off switch
When a feature misbehaves or is being abused, the fastest fix is turning it off, without a deploy.
A new export feature is being used to scrape customer data. A payment integration starts double-charging. An AI chat feature is saying things it shouldn’t. In each case the first question is the same: how fast can we turn it off?
If the answer is “build, review and deploy a change”, that’s an hour on a good day. A kill switch is a setting that disables the feature immediately.
- Put risky or new features behind a flag that can be switched off from an admin page or config store.
- Make “off” safe: the app should show a friendly message, not crash.
- Decide in advance who may flip it, and make sure that person can reach it at 3 am.
- Test the switch before launch. An untested off switch is a guess.
- Remove flags you no longer need, so the list stays readable.
It feels like extra work until the first incident. Then it’s the most useful code you have.