- name: private-order-cache
  where: "app/api/orders/[id]/route.ts"
  ensure: >-
    The GET handler response for an authenticated order must set Cache-Control to private, no-store. It must never advertise public caching.