I was chatting with a customer about cache-bypass attacks through query string enumeration. It's an interesting mind shift that with framework-defined infrastructure on @vercel for the most common request types this entire threat-class disappears because the routable URLs are known at the edge and inferred from the code you wrote. Respectively, the CDN-layer *knows* that a query string will have no impact on the response and respectively can access a cached version without bothering to check back with the origin. The same is true for path enumeration and 404s. The 404 can be served directly from the edge with minimal effort.