if you put anything up on the web, rest assured someone/something will find it.
having it password protected is 1 step to preventing unwanted snooping assuming they do not break your password protection.
when it comes to "demo" shops, i'm a big fan of developing locally on your own machine. personally, i use vagrant, git, and bitbucket to develop and then push out to a live site.
i suppose there is a learning curve to it all; but one needs to find out their own path for making a development environment secure and free from unwanted snooping.
frankly if you put something out on the web, people will find it.
author of square Webpay, now with Apple Pay and Google Pay.
mXworks
donations: venmo or paypal accepted.
premium consistent excellent support. available for hire.