When a Published Demo Shows Something It Should Not

• Unpublish the demo, before editing it. Stopping the bleeding beats a careful fix.
• Find every embed. Your site, landing pages, emails already sent, a partner's page, a directory listing.
• Check the exports. A video or GIF made from it is a separate file with its own life.
• Write down what was visible and for how long. You will need it, and memory degrades fast.

Editing the step removes it from the live demo. It does not remove it from search engine caches, from someone's screenshot, or from an email already delivered — and it does not remove an exported video sitting in a shared drive.

Assume anything published for more than a few hours may have been copied, and act on the assumption rather than hoping.

If it was another company's data, tell them, promptly and plainly: what was visible, roughly how long, what you have done. Being told by you is a manageable conversation; being told by their own customer is not.

If it was personal data, this may be a notifiable incident, which is a question for your counsel rather than for a blog. Have the facts written down before you ask.

Almost every incident of this kind traces back to recording against a real account because it was quicker. The prevention is a seeded demo environment and the habit of using it, not a review step that gets skipped when someone is in a hurry.

A brief second pair of eyes before publishing catches most of the rest, and takes about two minutes per demo.

• Personal Data in Product Demos
• Interactive Demo Security: What Actually Leaves Your App
• How to Build a Demo Account Worth Recording
• Auditing a Demo Library Nobody Has Looked At