demo: sensitive data detection + waf block

two path prefixes, same synthetic payloads, two different products. the log prefix demonstrates cloudflare sensitive data detection (sdd) inspecting response bodies. the block prefix demonstrates a waf custom rule stopping the request outright. all payloads are synthetic — reserved-invalid or industry test values.

# log endpoints — sdd detects on response

each endpoint returns synthetic pii of the requested type. request reaches the origin function, function returns the payload, sdd inspects the response, finding shows up in cloudflare security events. no visible impact to the client — the response body is delivered unchanged.

# block endpoints — waf stops the request

a waf custom rule matches the path and returns a branded 403 response. the origin function never runs. this is the mechanism you'd use if you knew a route was leaking and needed to shut it down immediately while fixing the origin.

# from curl

# log path — 200 with the synthetic payload; sdd records a finding server-side
curl -i https://rhocfsandbox.com/api/sensitive-log/cc

# block path — 403 with branded block body; origin never touched
curl -i https://rhocfsandbox.com/api/sensitive-block/cc

# what's the config

# where to look on the cloudflare side

• security → events: filter by ruleset "sensitive data detection" — sdd findings from the log path
• security → analytics: sdd shows up as a distinct category over time
• security → waf → managed rulesets: sdd deployment settings
• security → waf → custom rules: SITE_sensitive_block_request shows request-side blocks