Embodiments of the present invention disclose a method, computer program product, and system for generating a secure sandbox environment. A computer identifies components of a production environment that utilizes sensitive information during operation. The components of the production environment can include one or more server computers, one or more storage devices, and one or more applications. The computer receives a security policy that defines what constitutes sensitive information, and in response identifies the sensitive information of the production environment. The computer modifies the sensitive information such that the production environment can utilize the sensitive information without error, and such that the sensitive information cannot be identified from the modified sensitive information. The computer generates the sandbox environment, based at least in part, on the identified components of the production environment and the modified sensitive information.