If a demo environment isn't tightly scoped and audited, it's production in practice. The demo label doesn't matter.