If you let sandboxed code reach one domain, it can leak your secrets through that domain. Why network allow-lists have a structural blind spot, and how an L7 proxy with data-loss prevention closes it.