It tends to be more complex than this for several reasons:

a) you usually cannot simulate the exact behavior of users in production environment. Users tend to be quite creative in ways they approach your workflows and your artificial tests might not catch it b) Your dev/test/staging environment is usually not a 100% replica of the production site - you might lack access to some integrated systems, have different datasets for confidentiality reasons, use virtualized machines instead of physical, etc c) Or anything else which all leads to the sad fact that oftentimes you just cannot replicate the leak in any other env than production.