The boring reversible deploy from a fresh clone is such a cheap test for how much it reveals. The 2FA codes landing on the previous developer's phone is the one I see bite people most, usually months later when a registrar asks for verification.