Security and privacy principles.
Private mail and account surfaces are kept separate from public tools and advertising surfaces.
Account protection
Sessions use HttpOnly cookies. Passwords are stored as hashes, not readable text. Sensitive routes are not indexable.
Public tools
Tools query public DNS only. They do not send email, read mailboxes or need account credentials.