Well I've just created an account on substack to test this but turns out they've already fixed the issue (or turned off their WAF completely)