The importer validates the host two ways, both naive: an allowlist that only checks whether the authority starts with the approved CDN domain, and a string blocklist that only knows the literal spellings localhost and 127.0.0.1. A host can be written many other ways, and the allowlist check is trivial to prefix. The internal service lives at port 8099.