API responses include appropriate cache headers

Authenticated API endpoints without explicit Cache-Control: no-store headers can be cached by a shared CDN or proxy, serving one user's private data — billing details, profile information, personal records — to the next user who hits the same cache key. This maps to CWE-524 (use of cache-containing sensitive information) and OWASP A02:2021 (cryptographic failures in data protection). Mutation endpoints cached by a CDN can also return stale success responses to clients while the actual operation does not re-execute.

Add explicit Cache-Control headers in app/api/ route responses based on endpoint type. In Next.js App Router, set them in the Response constructor:

// Mutation endpoints and authenticated user-data endpoints
return new Response(JSON.stringify(data), {
  headers: {
     'Content-Type': 'application/json',
     'Cache-Control': 'no-store',
  },
})

// Public static data endpoints (e.g., config, pricing)
return new Response(JSON.stringify(data), {
  headers: {
     'Content-Type': 'application/json',
     'Cache-Control': 'public, max-age=300, stale-while-revalidate=600',
  },
})

Alternatively, set Cache-Control: no-store for all /api/ routes in next.config.ts headers config and override only where caching is intentional.