testing-apps.hr.company.com will not cause proper browser security model segregation - it is possible for
hr.company.com to set cookies than can be read by
testing-apps.hr.company.com will be able to set cookies on the
hr.company.com domain. So you have to trust both
testing-apps.hr.company.com in order to use either, so it could be argued that LastPass accidentally completing the password details on one application is not that big of a flaw - the testing environment should be on a completely separate domain to prevent any vulnerabilities found from exposing the live domain. Additionally, passwords should never be stored in log files so while it could be considered a small bug (maybe it should prompt before filling a form on a different subdomain), it is not a huge security weakness in itself - the underlying web application needs to be trusted, which includes considering the browser security model. It could be that
testing-apps.hr.company.com is only available internally. however this could allow a local attacker to compromise another employee's live account using a flaw on the test version.
In this case you can make this particular password manager more secure by configuration. e.g. disabling auto fill, and there is also an option in settings called URL Rules. Here you can set whether the hostname has to be an exact match. You cannot stop people using software in an insecure fashion, you can only guide and educate them, as you have pointed out.
My question is this: These can't be the only examples of unsafe use of password managers. What other gotchas are out there? Can anyone recommend guidelines for safe use of password managers in an organization?
There will be flaws in all applications, whether at enterprise level or not. The advantage of browser based password managers is that is can protect against phishing attacks. The URL is validated and as default only the credentials saved for that URL will be completed. If this is something you want to protect against then you will pretty much need to use a browser based password manager. If using something browser based is too much of a risk then you can use a separate application, but you must accept that an unwitting user may accidentally log into a wrong website, whether a malicious one or not, potentially exposing their login credentials to a 3rd party.
The specific guidelines will differ depending on the software used and how passwords are used within the organisation, as well as the organisation itself. For example. does the organisation trust the cloud, or is everything done in house? Storing password data on trusted internal servers might be better, however the organisation is then taking on the extra work of making sure the infrastructure is properly secured and ensuring that the data is properly encrypted and encryption keys are securely stored.