The author discovered that their static site was serving an internal engineering handoff document to anyone who requested it. The 150KB file, which contained an admin query-string parameter that bypassed payment during onboarding, a description of a known schema hole allowing accounts to be marked as paid without paying, database identifiers, and tooling configurations such as .claude/launch.json and GitHub workflow files, was publicly accessible on the production domain. This occurred because the static host's build output directory was configured as the repository root, causing every committed file—including dot-directories and documentation—to be published as a public URL.
Initial attempts to remove the exposure by deleting the files and redeploying, followed by two cache purges, were unsuccessful. Investigation of the response headers revealed a `cf-cache-status: DYNAMIC` with an age that steadily increased (from 4,396 to 67,735 seconds), indicating that the zone-level cache never held the file; instead, the static host's own asset/edge tier served the stale copy. This was confirmed by observing that the provider's default domain (pages.dev) served the clean version while the custom domain continued to serve the outdated file, proving that the purge tool and the layer holding the stale copy were two different systems.
The leak was ultimately closed by adding a firewall rule at the edge that blocked requests matching specific path tokens (the leaked document's path, .claude/, and .github/), which runs before cache consultation and takes effect immediately. Rotating the admin parameter revealed in the document provided little protection because the value was already embedded in client-side source and remained visible after rotation. The author emphasizes that the real fix was to close the server-side schema hole described in the leaked document, which rendered the admin parameter ineffective regardless of who knew it.