None
FI
Leaking secrets through caching with Bunny CDN
['Caching Vs Http Authorization', 'Strip Authorization Headers All Incoming Requests Default', 'Treat The Authorization Header As Part Of The Cache Key', 'Caching Responses Per User', 'Never Cache Responses For Requests With An Authorization Header', 'But Do Use Existing Cached Responses If Available']
HTTP Toolkit
A shared cache MUST NOT use a cached response to a request with an Authorization header field to satisfy any subsequent request unless a cache directive that allows such responses to be stored is present in the response. If the Authorization header skips response caching but not request cache lookups (and isn't in the cache key) then successful anonymous responses may be served to authenticated requests when they're already in the cache.