[semiquaver]

There is no “the toggle”. Read the article. A GHES appliance (and github.com) is dozens of services working together, some of which act differently in ES mode, so there are toggles galore. But probably not a lot that can be toggled by user input :(

[trashb]

I did read the article and that was a direct quote from the section "From GHES to GitHub.com".

The parent comment was talking about the "GitHub Enterprise Cloud" not "GitHub Enterprise Server" which are two distinct products.

The way that they where able to escalate the RCE from a GHES environment to github.com environment is by injecting this header and enabling this enterprise feature. This supports the idea that "Github enterprise cloud is on github.com".