We ran into a discovery today that is very concerning. An employee of ours was testing our customer center and entered his email address and normal password he uses and when he logged in noticed he had a customer center from another company in his list of accessible centers.

I know there are discreet ways to avoid this, but even that still has the chance of having problems specifically if you want to allow customers to change their email or password in the center preferences.

As Netsuite grows in popularity, this may become quite common since Netsuite relies on the email address as the login. This is no longer a unique id since it is reasonable that a customer of multiple NetSuite-based companies will have the same email address used.