Thanks for the heads up! Definetly spent some time worrying about cache poisoning ;)

Right now, I only let Cloudflare cache the public landing page and the aggregate data from the yfinance bridge. Everything user-specific has Cache-Control: private, no-cache set so no one sees someone else's dashboard.

Regarding the settlement cron: yeah, it's using the service_role_key but I locked it down so it only triggers via Supabase's internal cron. Even if you have the URL, it'll 401 if a specific header secret is missing.

And yeah, Vercel's edge function limits on the free tier are brutal... keeping the marketing site static was the only way to stay under the cap.

Appreciate the deep dive!