Comment by davidwtbuxton

Interesting security bug in Google Cloud's IAP, from 2021. Since fixed.

https://cloud.google.com/iap/docs/concepts-overview