we can just nuke the caches for all the domains that turned on the problematic features (Scrape Shield, etc.) No, IIUC it's MUCH worse than that : a single ngi

we can just nuke the caches for all the domains that turned on the problematic features (Scrape Shield, etc.) No, IIUC it's MUCH worse than that : a single nginx process would serve many different domains, and you would only need one of them with the problematic features turned on to trigger the bug, and potentially leak data from all other domains served by that same process (whether those other domains had the feature enabled or not) I'm not familiar enough with CF's infrastructure to make an educated guess about the way they shard domains across their nginx fleet (assuming this is what they do), but in order to be able to produce a list of all "tainted" domains that were being served together on the same nginx process, at any point in time since September 2016, well their nginx config generation process had better be perfectly deterministic (and any changes thoroughly logged over time). Also, the bigger the shards, the more neighboring domains are affected by a single "poisoned" one, and the more widespread the problem is. My guess is that if they had had a way to reliably piece together that information, they would have released a list by now.