Both things can be problems.
1. You should host dev stuff and separate domains.
2. Google shouldn't be blocking your preview environments.
1. You should host dev stuff and separate domains.
2. Google shouldn't be blocking your preview environments.
Is it far fetched that the people controlling a subdomain may not be the same that control the domain?
To be clear, the issue here is that some subdomains pose a risk to the overall domain - visiting any increases your risk from others. It's also related to a GitHub workflow that auto-generates new subdomains on demand, so there's no possibility to have a fixed list of known subdomains since new ones are constantly being created.