SUBDOMAIN TAKEOVER PROOF By HIDEKHAN

Authorized security-test page — served from a claimed Fly.io app behind a dangling CNAME.

request host
document.domain
origin
protocol
cookie visibility
served at (UTC)
app	`evaluation-service-production`

If this page renders at https://primary.reforge.com, a third party controls content on a reforge.com origin. Read-only proof: it prints values and stores nothing. Remove the DNS record or reclaim the Fly app name to remediate.