XC needs improvement on how to handle URL evasion. I've been working with the SA team to prevent URL evasion from happening by creating and updating regex rules, which isn't scalable or predictable as the attackers are constantly changing the URL to hit the origin.