Won't anubis do the same?

Due to implementation chosen by Cloudflare, allowing Cloudflare also allows the proxied website to run code, because Cloudflare blends with it, but why the proxied website should be trusted if the challenge is served by Cloudflare?

I might whitelist Cloudflare, but it pretends to be not Cloudflare, because it's MITM by design.

>This is the equivalent of a "Do you guys not have phones??"

Remotely related: https://ottawacitizen.com/news/manor-park-ottawa-sidewalk-re... there are dozens of us, dozens.

Well, yeah it's a bug just like the NullPointerException. You see how a buggy program behaves.