The current Trapper item configuration contains an insecure default value for the Allowed hosts field. According to the documentation:

List of comma-delimited IP addresses (optionally in CIDR notation) or DNS names.
If specified, incoming connections will be accepted only from the hosts listed here.

In the default configuration, without enforced encryption, anyone can push values. Proper and secure logic for the "Allow list" is "deny all unless explicitly set". Currently, it is the other way around.