Your WAF is enabled. Your dashboard is green. And every attack hitting your application is going straight through to the backend.

Tl;Dr: Why I got paged out on a Sunday evening for an ATO issue.