The compliance report a search engine had already indexed

This company is invented. Both findings are routine on multi-host reviews.

An industrial supply business ran a public catalog site, an online ordering portal, a file-sharing host for large CAD drawings, and several older subdomains accumulated over a decade. They put eight internet-facing hosts and four login roles into the written scope under our Infrastructure plan.

Two findings stood out right away:

1. An internal audit report in a public folder: On the file-sharing host, last year's IT compliance report—uploaded temporarily to share with an outside auditor—was still sitting in an unauthenticated /shared/ directory. Search engines had already indexed the URL.
2. A forgotten staging server from a 2023 redesign: During scoping, someone remembered staging-order.field.example and added it to the signed list. It was still running an unpatched 2023 build of the ordering app connected to a copy of real customer addresses.

The public document was taken down the same afternoon we flagged it. Retiring the staging server took three weeks because an outside hosting vendor had to decommission the instance. At the complimentary re-scan within the 60-day window, both items—along with three role-permission fixes inside the ordering app—were verified closed.