The branch for the PR shouldn’t be hosted on the production site’s domain, and that deployment that the company will be testing and reviewing shouldn’t be accessible to the public. They even have internal in the URL, while being accessible by external people lol