IMHO the default HTTP trust model where a domain implicitly trusts its subdomains is at fault here, when the logical solution would be to remove the trust altog

IMHO the default HTTP trust model where a domain implicitly trusts its subdomains is at fault here, when the logical solution would be to remove the trust altogether or at least make it explicit both ways. With regard to Bitwarden's default behavior to match the whole domain, it's irritating even when it's not a risk. We manage a ton of our systems under the same domain to allow a single 2FA signon before even giving access to the individual services and all the credentials have to be manually set as host-only or they will be autofilled for every other system we're managing.