Bug in Security Rule: 'OR' Operator Not Excluding Specified Countries

I activated a security setting on my website to display the traffic verification challenge and prevent bot spam. However, I noticed that the "or" function is not working correctly. When I add only one country to the exceptions, traffic from that country bypasses the challenge as expected. But if I add the "or" operator with more countries, all traffic goes through the challenge, including the countries that should be excluded from it. Is this the right place to report this bug?