Sensitive data exposure in development environments is one of the most consistently underestimated vulnerabilities. Attackers don't distinguish between production and testing pipelines — unencrypted PII anywhere in the pipeline will eventually be discovered.
“Dev environments are production to an attacker. Encrypt PII everywhere.”