“You need to blacklist the rest of the traffic, but only whitelist the proxy”

Transcript evidence from Tin Zaw -- ModSecurity and #AppSec.