Seen so many “add this WAF rule”, “here’s how to bypass that rule’s regex”but not enough “lock down your egress”