Can Netlify deploy previews be exploited?

Yes, Netlify deploy previews create publicly accessible URLs for every branch and pull request by default. These previews can expose unfinished features, debug interfaces, test credentials, and staging configurations to anyone who discovers or guesses the URL. If your previews use production environment variables, they may connect to live databases and services. Attackers can find preview URLs through GitHub pull request links, DNS records, or URL pattern enumeration. Restrict preview access using Netlify password protection or configure separate environment variable scopes for previews. UNPWNED helps you identify what is publicly exposed across all your deployment URLs.