It's good security practice to have separate sandboxes/domains for various types of services so it's harder for people to pivot from one to another in the event

It's good security practice to have separate sandboxes/domains for various types of services so it's harder for people to pivot from one to another in the event of an exploit. Similar to having a different domain for internal services, if you host user content on your site you should host all that user generated content on a different domain so it can't access your cookies etc.