CDN cache poisoning: someone else's cart

The ShopFast case file: on Black Friday a CDN rule cached /api/* by URL path alone and ignored the origin's private headers, so one user's cart, address and card digits reached others while every backend dashboard stayed green. How it was found, contained and fixed for good.