The combination of these factors allowed the endpoint to be publicly reachable for a short period before the WAF detection.
