First and foremost, host the hosted script that you let users use on a different domain - especially if you're letting random people upload random files to your primary domain!
Yes this is 100% correct and I was thinking the same. The homepage, test storage and external script cannot share the domain. I have already started making these changes.