AI girlfriend review site's secrets were exposed to the world for three weeks

PWNED Welcome back to PWNED, the weekly column where we explore the frightening and amusing world of foolish infosec errors.

This week, it's all about a test site that exposed real information.

Have a story about someone leaving a gaping hole in their network? Share it with us at [email protected].

Anonymity is available upon request.

Our story comes courtesy of Mia Morin, Editor & AI Quality Analyst at Intimeros, a site that rates, reviews, and evaluates AI companions – yes, that means boyfriends and girlfriends, as well as other kinds of pals.

The trouble started during a redesign when one of Morin’s colleagues was working on a test version of the site.

The test site was supposed to be password-protected, but the colleague turned off the protection so they could show a client what they were working on.

Password protection remained disabled for three weeks without anyone noticing.

Then, one day, Morin noticed that the test site had been indexed by Google.

Apparently, nobody thought to use a robots.txt file to exclude this beta-level domain from search.

While the site was publicly accessible without password protection, anyone could see unpublished reviews, prices, and private product notes about the different AI companion services.

That’s because the test site was connected to a real live version of the production database.

This was all editorial content, so no user data was exposed.

However, it could have allowed competitors to see everything that Intimeros was working on and to deduce their entire editorial strategy.