New posts in Sub Domain

Any threats from isolated subdomain (controlled by hacker)?

HSTS on a subdomain with includeSubdomains

Double Submit Cookies vulnerabilities

How can I find subdomains of a site?