@aeva “snuck” might be stretching it though, this was at the end of a two week marathon port from fastly to cloudflare workers precipitated by things happening at the company, so both my pair and I at least looked at the code and said, blearily, “yeah that looks ok”
(and to be fair cloudflare did say “hey you need to check host headers”)