> Using domain names for testing that don't yet exist but could in the future is a huge security hole that you must fix now. I disagree that this is something

> Using domain names for testing that don't yet exist but could in the future is a huge security hole that you must fix now. I disagree that this is something that Google needs to do on my behalf. If a cybersquatter squats on <my-startup>.dev, I don't consider it broken if I can't access their squat page. If I'm overriding random domains without doing my due diligence, then I get what I deserve (and probably wanted the results anyways). If somebody is spoofing a domain as a method of cyber attacking, the domain owner should have had HSTS if they had dignificant digital assets and they would already be using a non .dev domain.