WAF rule deployment blocks admin API but misses the real attack path

A hotfix rule stops valid management traffic while the malicious request pattern still finds an unprotected endpoint.