sadeshmukh

Even if you use a common subdomain, anecdotally I get orders of magnitude less bot traffic than not using a wildcard cert.

Once the data is sent to the client, in an untrusted setting, all bets are off. Not your hardware, no control over it.

Security by obscurity has never been real.

Ironic that the site itself is even more evidently vibecoded.

Correct, it's (afaik) full time and in person, with a salary.

You can do workspace wide data export