Two flaws in Splunk Enterprise and Splunk Cloud Platform show how browser-driven control planes and app-install paths can turn routine administration into a security boundary problem.