3 ms·

Its not just startups. I work at a major company and we’ve had internal domains flagged in the past due to internal security testing. We resolved it by making s

Its not just startups. I work at a major company and we’ve had internal domains flagged in the past due to internal security testing. We resolved it by making some calls to people at Google because the Safe Browsing dashboard is so slow to fix things. This is especially troublesome if you allow customers to upload code to run on your systems (e.g. Javascript for webpages or interactive data analytics) You have to isolate every customer on separate domains.

yuriko_boyko 6y ago
But you can smother the damage; startups can't.
scott00 6y ago
Do you need a real domain for each customer or is a subdomain sufficient isolation?
- dharmab 6y ago
  Real domain. If you have customer1.example.com and customer2.example.com, and customer2.example.com serves malware, all of example.com can be flagged.
  - chii 6y ago
    apparently, submit your domain to https://publicsuffix.org/ https://publicsuffix.org/ to prevent this from happening?
mr_toad 6y ago
> You have to isolate every customer on separate domains. Allowing unvetted JavaScript to be served from your main domain is something of a security risk anyway.