False sense of security.
The moment to fuck up certificate issuing and don’t use a wildcard certificate, the subdomain is public and will be probed to hell and back. And due to regex, probably by bots specialized to probe password vaults.
Wish you best of luck and security.
But I’ll stay here :)