@SonarResearch The other commenters here have very creative solutions. But there is a simpler way if github.computer isn't available anymore because @becojo already bought it:

Regex.IsMatch() does not perform a global regex match, it just searches for a match somewhere in the string. Also, the regex does not use $ to match for the end of the line. This leads to an empty string matching the regex (remember that * matches 0-inf chars). So the regex does not do anything and we can send an arbitrary path. (https://replit.com/@realansgar/BlueInfatuatedConnection#main.cs)

https://api.github.com" does not end with a slash. So we can append a path like .attacker.com and register api.github.com.attacker.com and capture the authHeader.