I run a check that reads Cloudflare's edge logs and asks one question: is this

zone serving anything that no sitemap and no allowlist accounts for? Paths that

look like live identifiers — a 32-character hex string, a token in a query

string — get masked before they are compared, printed, or written to disk. The

mask carries a short keyed hash so that four hosts serving four different

secrets do not collapse into one identical row.

That keying is the subject of this post, because it has a key, and keys get

lost.

The guard worked

Somebody on dev.to pointed out the hole in October: if the key ever changes,

every masked suffix moves, so every masked path becomes a path the baseline has

never seen. Five findings that look new, read like new, and get folded straight

into the baseline — orphaning the reviewed notes that explain them.…