AI girlfriend review site's secrets were exposed to the world for three weeks
Even testing and staging sites need protection from prying eyes
Welcome back to PWNED, the weekly column exploring foolish infosec errors. This week's story involves a test site for Intimeros, a site that rates and reviews AI companions. During a redesign, a colleague left password protection disabled for three weeks. Unknown to anyone, the test site was indexed by Google due to the absence of a robots.txt file.
This allowed anyone to view unpublished reviews, prices, and private product notes about the different AI companion services. Importantly, the test site was connected to the production database, putting Intimeros' editorial strategy at risk. After noticing the issue, Mia Morin took action to secure the test site - reinstating password protection, blocking search engine indexing, and changing system access keys.
Intimeros now employs weekly automated scans to catch exposed pages. The lesson here is clear - never overlook the security of test or staging versions of websites. Ensure they require logins and have tools to block search and AI crawling. For added security, consider hosting your staging site on a private server that requires a VPN for access.
Written by urgent.news from The Register Science's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
