Source:
The RegisterEven testing and staging sites need protection from prying eyes
PWNED Welcome back to PWNED, the weekly column where we explore the frightening and amusing world of foolish infosec errors. This week, it's all about a test site that exposed real information. Have a story about someone leaving a gaping hole in their network? Share it with us at pwned@sitpub.com. Anonymity is available upon request. Our story comes courtesy of Mia Morin, Editor & AI Quality Analyst at Intimeros, a site that rates, reviews, and evaluates AI companions – yes, that means boyfriends and girlfriends, as well as other kinds of pals. The trouble started during a redesign when one of Morin’s colleagues was working on a test version of the site. The test site was supposed to be password-protected, but the colleague turned off the protection so they could show a client what they were working on. Password protection remained disabled for three weeks without anyone noticing. Then, one day, Morin noticed that the test site had been indexed by Google. Apparently, nobody thought to use a robots.txt file to exclude this beta-level domain from search. While the site was publicly accessible without password protection, anyone could see unpublished reviews, prices, and private product notes about the different AI companion services. That’s because the test site was connected to a real live version of the production database. This was all editorial content, so no user data was exposed. However, it could have allowed competitors to see everything that Intimeros was working on and to deduce their entire editorial strategy. After she noticed what was wrong, Morin took swift action to protect the test site from prying eyes. “We restored password protection, blocked search engines from indexing the draft pages and changed all the system access keys,” Morin said. “Now, we secure every test site just like our official website and run weekly automated scans to catch exposed pages.” What we can learn from this is kind of obvious. Never forget to lock down the test or staging versions of your websites. Make sure that they not only require logins, but also have tools in place to block search and AI crawling. Better still, place your staging site on a private server and require someone to use a VPN to get to it in the first place. ®
Get AI news in your inbox
Daily digest of what matters in AI.