The standard things I would think of are:
- use another system (not the same VM/server as production)
- disable all DBA_SCHEDULER_JOBS and don't enable them back until you review their code
- disable all DBA_JOBS and don't enable them back until you review their code
- point DBA_DB_LINKS (both public and private database links) from the production databases to corresponding test databases or delete them; these sometimes use tnsnames.ora, but sometimes bypass it.