Optus detected the coding error that left the main domain vulnerable in August 2021 and fixed it but did not apply the same to the target domain.