The first step is to distance the domain of your project from the domain you use for user-generated content. Examples: github.com vs. github.io, wordpress.org

The first step is to distance the domain of your project from the domain you use for user-generated content. Examples: github.com vs. github.io, wordpress.org vs. wordpress.com (note that these are not subdomains, but distinct domains). Doing so allows you to keep the two separate as far as SEO is concerned, so that your main project isn't affected regardless of what users might upload. Then it's about putting out the fires whenever they appear. I'd also be careful about JavaScript, since a site hosted on example.com/a will have the same origin as a site hosted on example.com/b (and therefore access to cookies). This is where a separate subdomain for each user comes in handy (so a.example.com vs b.example.com), which shouldn't be much of an issue since DNS providers usually have an API that you can call, and DNS updates should be fast when you're creating entries (as opposed to modifying existing ones).