I'm glad someone mentioned "remove sensitive data". I know many places simply test against copies of live but we should be resisting it and pushing for proper development data sets.