So sloppy, this is why it becomes clear that your developers need to know the scope of your business. Best practices sure don’t leave an open server with production data. But, if you know you have tons of pii in there, you should treat that like proverbial nuclear radiating material and lock it down with whatever means are at your disposal, regardless of difficulty to do so.