← VCE Software Development U4O2

Combined development, testing and production environments

One shared environment used for development, testing and production, so untested code and live data mix and mistakes or attacks can reach real users and data.

Part of: VCE Software Development - U4O2 - Cyber Security: secure software development practices — Module 47

Understanding Combined development, testing and production environments in VCE Software Development U4O2

What it does: Giving developer accounts full production rights breaks least privilege. In a combined environment a single compromised account exposes everything. Using the real customer file for testing mixes live data with untested code, which is the core risk of a combined environment. With no separate testing stage, a change made by a developer can reach production straight away, even if it has bugs or vulnerabilities. Combining all three stages removes the barriers between them, so one compromise or mistake reaches everything. Separation limits the damage.

Common mistakes: In a combined environment, development, testing and production all use one shared environment. The line should be env = 'shared'. 'dev_only' contradicts the print message on line 2. The program shows what happens in a combined environment: testing runs on real customer data. Loading 'fake_customers' would be safe test data, so it contradicts the print on line 3. It should load 'live_customers'.

Class: _____________________  ·  Name: _____________________  ·  Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add Combined development, testing and production environments to a class →

This module's key terms are also in a printable crossword (Modules 23–47) and word search (Modules 1–47).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning
Duo
A team builds, tests and runs their app in one combined environment. What is the main security problem?
Untested code and live data mix, so mistakes can reach real usersThe app will always run slower than a separated setup
Matches
if (testsPassed == false) { deploy("production") }
↓
Code is deployed to production even when tests have failed, because testing and production are not separated. Untested or faulty changes go live. Deploy only when tests pass, and test in a separate environment first.
Applying
Meanings
Term
combined environment
Meaning
One shared environment used for development, testing and production, so untested code and live data mix and mistakes or attacks can reach real users and data.
Practice
environment ← "combined"
Testing
Gaps
testDatabase ←
Check Answer
Spots
1env = 'dev_only'
2print('Dev+test+prod:', env)

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

The 'Lion' badge — Inheritance King, one of Cloodit's 106 collectible badges
Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy
Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games
Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print
Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. A team builds, tests and runs their app in one combined environment. What is the main security problem?
A. The app will always run slower than a separated setup
B. Untested code and live data mix, so mistakes can reach real users ✓
In a combined environment there is no barrier between work in progress and the live system, so errors and attacks can affect real users and real data.
2. Which testing practice is a risk of a combined environment?
A. Testing new features using real customer data ✓
B. Testing new features using made-up sample data
When testing happens where live data sits, real personal information can be exposed, changed or deleted. Fake sample data avoids this.
3. A developer pushes a half-finished change in a combined environment. What is likely to happen?
A. The change waits safely until it has been tested and approved
B. The untested change goes live and may break the app for users ✓
With no separate testing stage, a change made by a developer can reach production straight away, even if it has bugs or vulnerabilities.
4. Which statement about developer access is true in a combined environment?
A. Developers end up with access to live production data and systems ✓
B. Developers can only ever see test data and test systems
Because everything is in one place, developers working on code also have access to production. This breaks least privilege and raises insider threat and human error risk.
5. An attacker breaks into the development part of a combined environment. What is the result?
A. One breach can expose everything, including live data ✓
B. The breach is limited to unfinished code only
With no separation, the attacker is already in the same system as production, so a single breach can expose live data, code and secrets.

Match the Pairs

DB_HOST = "live-db.company.com" # used by dev and test → Developers and testers connect to the live production database, so live data is used for testing and could be changed or leaked.
git push origin main # deploys straight to live server → Untested changes go live immediately, so bugs or vulnerabilities reach real users with no separate testing stage.
Developers have production access, so one stolen developer account or one slip can damage or expose every system and all live data. → dev_user.role = "production_admin"
Live customer records are copied into testing, so real personal data is exposed to staff and to any bugs or attacks in the test code. → test_data = load("live_customers.csv")
if (testsPassed == false) { deploy("production") } → Code is deployed to production even when tests have failed, because testing and production are not separated. Untested or faulty changes go live. Deploy only when tests pass, and test in a separate environment first.
environment = "shared" # dev, test and live together → Using one shared environment means a single breach or error exposes all code and live data. Fix it by using separate development, testing and production environments with their own access controls.

Key Term

combined environment
One shared environment used for development, testing and production, so untested code and live data mix and mistakes or attacks can reach real users and data.

Fill in the Blanks

1. testDatabase ← liveDatabase
Hint: Type the variable name for the real customer data that testing wrongly uses in a combined environment.
2. developer.saves(newCode) production ← newCode
Hint: Type the name of the environment real users rely on, which receives the untested change.
3. GRANT ALL ON liveData TO developer
Hint: Type the keyword that gives a user permissions, here handing developers access to live data.
4. IF breach(sharedServer) = TRUE THEN exposed ← dev + test + live
Hint: Type the part of the shared system holding real user data that is also exposed in one breach.
5. combinedEnvironments ← 1 separatedEnvironments ← 3
Hint: Type the number of environments used when development, testing and production are combined.

Spot the Error

Question 1
A env = 'dev_only'
B print('Dev+test+prod:', env)
C deploy(env)
Line A — In a combined environment, development, testing and production all use one shared environment. The line should be env = 'shared'. 'dev_only' contradicts the print message on line 2.
Question 2
A env = 'shared'
B data = load('fake_customers')
C print('Testing on live data')
Line B — The program shows what happens in a combined environment: testing runs on real customer data. Loading 'fake_customers' would be safe test data, so it contradicts the print on line 3. It should load 'live_customers'.
Question 3
A def save_change(code)
B live_site.update(code)
C return 'Live now'
Line A — A Python function definition must end with a colon. The line should be def save_change(code):. The function pushes untested code straight to the live site, as happens in a combined environment.
Question 4
A change = edit('login.py')
B live_site.update(change)
C print('Tested before live')
Line C — In a combined environment the change goes live without separate testing. The message should say the untested code is live, but the broken line claims it was tested first. It contradicts line 2.
Question 5
A dev = 'sam'
B perms = ['dev','test','prod']
C if 'prod' == perms:
D print(dev, 'edits live')
Line C — To check whether 'prod' is one of the permissions, use the in operator. Comparing a string to the whole list with == is always False. It should be if 'prod' in perms:. The developer has production access.

Student with a class code? Join your class →