This is a known issue. I was doing some bug bounty work on a target, found a salesforce domain leaking data. Reported it responsibly, and they basically told me

This is a known issue. I was doing some bug bounty work on a target, found a salesforce domain leaking data. Reported it responsibly, and they basically told me to kick rocks. I have hear of similar issues from other security researchers.