ensureSiteExists auto-creates ANY site id on first event and the site's domains array is never checked at ingest — site ids are public in the tag, so anyone can poison a competitor's numbers or spray junk site ids as a write-cost attack. Fix: enforce hostname/Origin in site.domains (drop otherwise), gate auto-creation behind config (default off in production).
From the production-readiness audit (docs/research/production-readiness.md, eacf996). Verified with live probes where stated.