An admin surface seems protected by an edge allowlist but an alternate hostname still bypasses it through another proxy chain

The main route is locked down, yet the same backend remains reachable through a secondary hostname that never traverses the allowlisted edge path.