If you have real user data in non-production systems (e.g., development JIRA/tracking system) you're already doing it wrong. At the firm I work at we scan all

If you have real user data in non-production systems (e.g., development JIRA/tracking system) you're already doing it wrong. At the firm I work at we scan all non-prod systems for user identifying data and flag it up for removal.