I Was Sure It Was Locked. I Had Never Checked.

Twelve out of twelve outside places could reach a staff website I had told my assistant was locked.

It was an old internal site, the kind nobody opens anymore. Only our office computers were supposed to be able to see it. Just before noon on October 21, my AI assistant warned me it looked open to the whole internet. One minute later I said no, it was already locked, and to test it properly.

I was wrong. This is how I found out.

The test that proved nothing

The assistant ran its test from my computer. My computer is one of the allowed ones. The site answered, so the assistant took back its warning. It wrote in our notes that the site was restricted.

That is like testing a lock with your own key. Of course the door opens. It says nothing about anyone else.

For about two hours, that note rested on one test from the one kind of computer that was always going to pass. Anyone who read the note would have believed the site was safe.

The check from outside

Two hours later, a second assistant checked from 10 places outside our office. Nine answered. On those nine, the login page showed. The site’s security certificate had also expired, which is the digital ID that proves a site is the real one.

At 2:02 pm the note was corrected. At 3:12 pm, a check from 12 outside places got an answer from all 12.

What I got wrong

I had assumed it was locked. I never checked. I had a feeling, and I treated the feeling as a fact.

Nothing in my head said when I last knew it was locked, or how. There was no date and no test behind it. When the assistant said “open,” I trusted my feeling over its finding.

At 3:16 pm I told the assistant I had felt calm only because I assumed the site was behind a firewall. At 3:17 pm I said to take it offline.

What it cost

This was not a hack. But a login page was showing to the open internet, on software that stopped getting security updates years ago, with an expired certificate. That is an invitation, and I had waved off the person pointing at it.

At 3:25 pm the site was stopped, with a backup of its settings saved first. The same 12 places then found nothing there.

If you run an older website and want a second set of eyes on whether it is exposed, we can help with that.

Still open:

• Block it at the firewall, the gate in front of our network.
• Point staff links at the new help pages.
• Decide whether to retire the site or keep it.
• Audit our other old sites for the same problem.

Three things to do this week

Pick one thing you believe is private. A shared folder, a work account, a staff page. Then:

1. Write down when you last checked it and how. “Restricted, tested from an office computer that morning” reads very differently from “restricted.”
2. Ask your assistant, or a friend, to check from outside, from a place that should be turned away. A test from inside only shows what insiders see.
3. If someone says it is open, make them wrong with a real test. Do not overrule them because you feel sure.

My note said “restricted” for two hours on the strength of one test from my own computer, and 12 outside places answered it.

dxdev LESSON · paste into your AI coding agent
LESSON: Test Access Controls From Outside The Boundary, Not From Inside It
SOURCE: dxdev.com/blog/i-was-sure-it-was-locked-my-assistant-was-right
WHAT HAPPENED: My assistant raised a warning that an old internal staff website might be open, and I overruled it, saying it was already locked and should be tested properly. The assistant ran its test from my own computer, which is one of the allowed ones, so the site answered and the warning was withdrawn. A note then said the site was restricted, and it stayed on file for about two hours. A second assistant checked from 10 outside places, and nine answered, with the login page showing and the site's security certificate expired. A later check from 12 outside places got an answer from all 12, so I had the site taken offline after saving a backup of its settings.
THE RULE: Verify a restriction from vantage points that should be turned away, because a test from an allowed position only shows what insiders see. Do not overrule a contrary finding on confidence alone, and make the claim be disproved from somewhere you are not.
CHECK MY CODE, then report PASS or FAIL with file:line for each:
      1. Every recorded claim that something is restricted or private names where it was tested from and when, and at least one of those test points sits outside the allowed group.
      2. Any warning that an access control may be open is closed only by a test from a location that should be denied, never by a test from an allowed machine.
      3. Notes on security status distinguish a feeling or assumption from a verified result, and state how and when the check was done.
THEN PRINT: a table (check, PASS/FAIL, evidence, fix) + a verdict (applies / partially / OUT_OF_SCOPE / no) + the single most important next action.