The analogy doesn't apply because a hotel has an override using a master key. In this case, the website, hopefully, would just open a support ticket with CloudF

The analogy doesn't apply because a hotel has an override using a master key. In this case, the website, hopefully, would just open a support ticket with CloudFlare, and add a level of indirection that likely means my HAR file wouldn't even make it to CloudFlare. However, I think you make a good point that reporting to the website will put more pressure on CloudFlare or the website owner may choose a different vendor that has fewer problems. I think it's worth reporting to both in this case. Now that CloudFlare has engaged with this problem, I'll give them some time to try to fix it, and if they don't, I'll start complaining to every website that uses this CloudFlare feature.