In the cloud manager, you set "IP allow lists" to stop random public viewing your non-production / in-development instances. You set these lists to your office IPs and/or VPN IP. However, this shotgun approach blocks essential tools, e.g. blazemeter, pagespeed insights, webpagetest, lighthouse etc...