Comment by zaronkedl

Yes, we have host and ip filtering in place that can be used to ensure the secret is sent only for the destination we expect.

It's not perfect though, see Host Filtering | https://getkloak.io/docs/guides/host-filtering.html