An AI companion review website, Intimeros, accidentally left a redesign test site publicly accessible for three weeks after password protection was disabled for a client demonstration. The incident matters because the exposed site was indexed by Google and connected to the live production database, allowing outsiders potentially to view unpublished editorial material and infer the company’s strategy.

No user data was exposed, but visitors could access draft reviews, pricing information and private notes on AI companion services. Intimeros restored access controls, blocked indexing, changed system keys and introduced weekly scans; the case highlights the need to secure staging sites as rigorously as live websites.