Is there some whitelist to config? if not, someone can use same subdomain/region to build a site to do something bad, such as trigger the delete mutation.