An edge allowlist seems correct but one alternate hostname still exposes the admin surface

A team locks down an admin interface and later discovers an internal or legacy hostname still reaches the same endpoint without the edge policy.