A Cloudflare Access app is protected on 443 and an alternate admin port...

The primary hostname is secured, yet the admin channel is still exposed because it never entered the Cloudflare-only trust perimeter.