Specifically, he added "X-Forwarded-For abcd: z" to the header for HTTP requests, which bypassed the AWS IP address restriction policies in AWS API Gateway.