Test environment let anyone access live customer data

In a recent security incident, a test environment was discovered that allowed unauthorized access to live customer data. The situation occurred at SmartRepl, a company offering business AI services like AI receptionists and sales automation. During a security audit, Richard Schut, Managing Director and AI Software Researcher at SmartRepl, identified a test environment that was accessible outside the network and connected to a database containing live customer information.

The test environment had been created for a short-term purpose of demonstrating the application and testing the migration to the cloud. However, it remained running for months after initial setup. Due to the creators' unawareness of the possibility of unauthorized access, they did not implement the same authentication and access control methods used in production. The database SQL file was named "master_test_final.sql," which clearly indicated its contents.

Upon discovering the security vulnerability, Schut immediately restricted access to the staging environment. He and his team then conducted a review of other development and test environments in the company to ensure none of them were also open to exploitation. The takeaway from this incident is that security should not be compromised simply because an environment is intended for testing.

Even if a test server exists for a short period, it should be treated as a real security asset, regardless of the developers' expectations for its duration. Schut emphasized that if an environment has access to real data, it must be treated with the utmost security concern, irrespective of the anticipated time it will exist.