Does CF redirect all non-HTTP traffic to HTTPS? If not, NSA could have passively intercepted tons of leaked data, and all it would take is for one of their analysts - people paid to find stuff like this - to notice a single out-of-place leaked secret and trace it back to CF.