The "for customer" web applications of a company are deployed in their pre-prod environments. The apps in these environments can be accessed without any VPN. All you need is the public url. I doubt if the code and databases can be accessed without VPN.

Are there any security concerns in this setup and is this a common practice in companies ?

2 Answers 2


It is not common practice. its generally not advised because developers dont usually code the application to behave exactly the same way in a test environment. Sometimes the js isnt minified, sometimes there are controllers that have debug urls,that could give somebody insight into how the application behaves behind the scenes. Ultimately it comes down to what information is available in that environment, and of what use would it be to somebody attacking the production application. This is assuming of course that you have no real data in the application.

  • I'd say its a relatively common practice from what I see, but its certainly not best practice! Commented Mar 3, 2017 at 14:03

The key word is this type of scenario is: segmentation. The main thing that you want segmented is data. You need to ensure that there is no production data in the pre-production environment. So to answer your question it depends what is accessible in this pre-production environment. If it's just a public URL, you need to ensure that the normal security controls are in place to prevent DDOS attacks, MiM, etc.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .