Inherited a codebase with zero tests and I'm terrified to change anything

First real job, and the main service has no tests, no docs, and the two people who wrote it have both left. Every change feels like defusing a bomb with the wire diagram missing.

I know "write characterization tests first" is the textbook answer, but where do you even start when you don't understand the code well enough to know what's correct behavior vs a long-standing bug? How did you get comfortable working in a genuinely scary legacy codebase?