Forgotten dev and test systems are goldmines. Here is how to find them.

Why staging environments leak

Developers need to test with real-ish data. They save credentials in browsers. They use weak passwords because "it's just staging."

Then their laptop gets infected. The stealer grabs everything. That staging URL with the lazy password ends up in a log alongside production credentials.

The difference: production gets rotated. Staging gets forgotten.

What to search for

Run the target domain through LeakRadar and look for URL patterns like:

  • staging.target.com
  • dev.target.com
  • test.target.com
  • uat.target.com
  • beta.target.com
  • internal.target.com
  • demo.target.com

Also check for port numbers in URLs. Staging apps often run on non-standard ports like 8080, 3000, or 8443.

Why these are valuable findings

Staging environments often have:

  • Weaker authentication or no MFA
  • Debug mode enabled with verbose errors
  • Test accounts with predictable passwords
  • Direct database access or admin panels
  • Older code with unpatched vulnerabilities

A credential that works on staging can reveal vulnerabilities that also exist in production.

The forgotten factor

Security teams focus on production. Staging systems slip through the cracks.

That staging server from a project two years ago? Still running. Still accessible. Still using the password that leaked eighteen months ago.

Nobody remembered to shut it down. Nobody rotated the credentials.

How to report it

Do not just say "I found staging credentials." Show the impact:

  • What systems can be accessed
  • What data is exposed
  • How this could lead to production compromise
  • Whether the staging environment shares infrastructure with production

A staging credential that leads to source code access or database dumps is a valid finding with clear impact.

Check if it is in scope

Some programs explicitly exclude staging environments. Others include anything on their domain. Read the policy before you report.

Even if staging is out of scope, the leaked credential itself might be reportable as a security awareness issue.

The quick win workflow

  1. Search target domain on LeakRadar
  2. Filter for dev/staging/test URL patterns
  3. Check if those systems are still live
  4. Document what access the credentials provide
  5. Report with clear impact chain

Five minutes of searching can surface findings that subdomain scanners miss entirely.

Find your next quick win on LeakRadar.io by searching for what developers forgot to lock down.