You ran into an issue where HTTPS was used but traffic was still intercepted. What caused that?

A security incident where HTTPS was enabled but traffic was still intercepted due to an exception that allowed arbitrary flows for an edge case. A proxy exploited this gap weeks later with no alerts triggered. The fix was removing all exceptions and enforcing strict transport security rules globally with no carve-outs.