Only allow registered custom domain origins on public GET/OPTIONS status page API routes instead of the entire application API surface.
Ian Troisi