I thought I’d come back and update this post since I’ve received some helpful information from the Cloudflare team.
According to their engineering team:
There are two layers of caching with a site built on Pages using a custom domain. (ie - mysite.com → mysite.pages.dev) The cache the you control on the custom domain (mysite.com) and what Pages does. So although you purged the cache on your zone, Pages does have a cache retention policy of roughly one week for any assets. This was an intentional decision made to help mitigate any issues client-side when a user deploys a new version of their site.
Currently we have verified that the asset is no longer served from cache.
My main concern with this is that it becomes impossible to purge sensitive information that might have been published by accident. That sensitive information would hang around for 7 days after being removed. Not ideal!
Edit: The Pages team came back with this.
Regarding the sensitive data issue purging, they said:
We are aware of this concern and are working for a solution related to Pages Caching improvements or a config to handle this better
Since the Pages cache only applies to old, deleted files, a workaround I’ve found would be to:
Overwrite the data containing sensitive data with an empty file of the same name.