And most bugs are often found before going into production, so client's will be accessing the site behind an IP restriction or HTTP auth most likely.