Only if you don’t pin your cookies to the subdomain and/or are not using HTTPOnly. Even if you screw that up, cookie tossing in general is a rather low risk ite

Only if you don’t pin your cookies to the subdomain and/or are not using HTTPOnly. Even if you screw that up, cookie tossing in general is a rather low risk item; I don’t think its accurate at all to say “if one site gets hacked so does the other.”