Can Netlify deploy previews be exploited?

Yes, Netlify deploy previews create publicly accessible URLs for every branch and pull request by default. These previews can expose unfinished features, debug interfaces, test credentials, and staging configurations to anyone who discovers or guesses the URL. If your previews use production environment variables, they may connect to live databases and services. Attackers can find preview URLs through GitHub pull request links, DNS records, or URL pattern enumeration. Restrict preview access using Netlify password protection or configure separate environment variable scopes for previews. UNPWNED assesses externally observable exposure on each authorized URL that is submitted; it does not enumerate every deployment URL.