Test environment let anyone access live customer data

In a recent security incident, a test environment created for cloud migration purposes inadvertently provided unauthorized access to live customer data. Richard Schut, a Managing Director and AI Software Researcher at SmartRepl, discovered the issue during a security audit. The test environment, which was accessible outside the network and linked to a database containing real customer information, had been left running for months despite being intended for a short-term purpose.

The SQL file responsible was named master_test_final.sql, indicating it held sensitive data. The developers did not implement the same authentication and access control methods used in production environments, leading to a significant security flaw. Schut emphasized that security risks can stem from simple oversights, such as leaving a test environment active for an extended period.

After the discovery, Schut and his team took immediate action to restrict access to the staging environment and conduct a thorough review of other development and test environments within the company to prevent similar vulnerabilities.