> The biggest offence here is to have the test envs accessible publically. I don't know if it's the case for Starbucks, but many large companies like that rely

> The biggest offence here is to have the test envs accessible publically. I don't know if it's the case for Starbucks, but many large companies like that rely on a bunch of outside vendors/agencies for their development, with the relationships primarily managed by their marketing department. The test environments tend to be synonymous with staging environments, and need accessed by a variety of partners (and the actual company employees responsible for it) for the partners to do their part of the process and for the company employees to do their version of acceptance testing. Sometimes the access gets gated for whitelisted VPN/office IPs only, but especially with so many people working from home currently, they end up having to just open things up completely. I would not have expected that based on the majority of my career, but I shifted into an agency environment with many Starbucks-like clients a few years ago, and it was like stepping into a whole new world. Our agency doesn't actually do dev work, but tend to be part of large inter-agency teams working on those sorts of projects. And that seems to be par for the course for 70%+ of the clients I've been involved in.