This is fantastic!!!

What kind of security considerations are there to having multi-tenant user applications on subdomains and then having them exposed like this?

I'm building a SaaS right now, and I guess one thing is that a given username can then be discovered as a valid login for the system...but obviously that's only part of the login credential.

Maintaining a list of mappings to opaque subdomains seems to reduce targeting, and conceal login partial credentials, but doesn't seem to offer much besides.

Analysis?