Companies that move away from Salesforce often forget to deactivate their sites, leading to the creation of “ghost sites” that contain sensitive corporate, vendor, and user data. These abandoned Communities within Salesforce environments can expose valuable information when administrators fail to remove or properly secure the data. Ghost sites can be identified using tools that index DNS records, and attackers can exploit them by tricking Salesforce into serving the site to them. The risks are compounded by the fact that old sites are less maintained and more vulnerable to attacks. It is crucial for companies to remember to deactivate Salesforce sites that are no longer active to protect their own data as well as the data of partners and users connected to the Community.