WAF allows the obvious route but still misses the attack

A WAF rollout follows public guidance and appears healthy. Later, testing shows the same app is still reachable through an alternate hostname that bypasses the protected edge path.