Cache Invalidation Audit

Operation

Inspect the named boundary and report supported findings. Do not edit product code. Include concrete evidence, impact, the owning source, one remediation direction and a meaningful validation route. Severity follows actual impact, not a category example.

Goal and scope

Audit one cache, CDN, browser cache, server cache, query cache, materialized view, or invalidation boundary for correctness, tenant safety, freshness, and failure behavior.

Domain invariants

• Cache keys include the correct identity, tenant, resource, locale, role/plan, and variant dimensions.
• Invalidations or TTLs match the authoritative data change and direct consumers.
• Stale reads, optimistic updates, concurrent writes, retries, and rollback behavior are intentional.
• Sensitive or unauthorized data cannot be served from shared caches.
• Tests or checks prove freshness and coherency for the selected boundary.

Audit method

Trace selected data from authoritative write through cache population, reads, invalidation, TTL, background refresh, client state, CDN/browser layers, and tests. Identify stale, over-broad, missing, or unsafe cache keys.