[new_here]

Yeah, I've just realised they've probably accidentally included a generic URL in the cache rules that they actually didn't intend to cache.

I originally thought they were trying to cache account data responses and so wondered why they wouldn't just use unique query parameters in that case. Definitely risky business though.

Out of interest, it looks like Cloudflare offers some sort of token authentication to authenticate at the edge: https://blog.cloudflare.com/token-authentication-for-cached-...