An edge allowlist seems correct but an alternate hostname still bypasses it through another proxy chain

The main route is protected, yet the same backend remains reachable through a secondary hostname that never traverses the allowlisted edge path.