IssueTracker

The version facility provides a great tool for trying out a new version
live before making it the default application.

However, as presently configured, it appears that any version of an App
Engine application can be publicly accessed, since the Live URI follows a
predictable pattern: <version>.latest.<appname>.appspot.com.  One
consequence of this is that a partially-developed version of an application
can be viewed by an interested outside party before it is ready for
release.

Clearly, there could be a number of reasons that a developer would not want
such unfinished code to be publicly accessed.  For example, the less tested
code might contain errors that would make it vulnerable to manipulation,
exposing the application's datastore, or allowing a spammer to hijack the
system to send unsolicited email.  Also, some developers might not want to
expose unreleased new features to potential competitors.

One partial solution to this would be to replace the word "latest" in the
non-default URL with a GUID that would be exposed only to the developers by
the version display's permissioned interface.  This would allow the non-
default version's URL to remain on the public Internet for realism during
testing, while at the same time protecting the development versions from
access by the general public.