Your Coalition finding is almost certainly a false positive caused by our shared reverse proxy layer. Inbound HTTP traffic to all services (including custom domains) routes through shared proxy IPs, so an IP-based security scan will see other customers' services at the same address. However, your service is fully isolated: traffic is routed by hostname, each service runs in its own container, and our private networking uses encrypted Wireguard tunnels scoped to your project and environment, meaning services in different projects cannot communicate with each other. No other customer can access your service's data, configuration, or internal network. You can share with Coalition that this is a shared-proxy architecture (similar to other PaaS providers like Cloudflare or any CDN) where IP co-tenancy does not imply application-level access between tenants.