[rbanffy]

> but given that the access was unauthorized

The access was not unauthorized. In addition to that, a lot of people thought the service was actually launched - there was no authorization step anywhere in the interface, nor mention that it was a "pre-release" or testing deployment.

> Does the developers making this publicly accessible for testing constitute a release?

This has nothing to do with what was done with the software by which users - they all have the same right to the source. All users have the same rights.

> Does the developers making this publicly accessible for testing constitute a release?

Yes. The software was available to users, therefore, those users have the right to see the modified code of the application they used, as granted by the AGPL3 license to which the website operators agreed.

[tolleydbg]

1. I didn't realize that anyone thought thought the service was launched. I've only seen reporting that it was discovered and defaced. This would make a difference.

2. and 3. The license can say whatever it wants and we can interpret it however we want, but at least for US law, it makes a difference whether or not this constituted a release/distribution to be a binding agreement. Non-binding contracts are not enforceable. If you have reporting that it was used by consumers, then this is different, but this doesn't seem to be the case.