sfcc-caching — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited sfcc-caching (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Caching in SFCC has multiple layers. The most common failures come from:
[ ] Choose cache layer: page cache (HTML) vs custom cache (data) vs service response cache
[ ] Design keys with site + locale scoping where needed
[ ] Use atomic get-or-load patterns (avoid double loaders)
[ ] Cache POJOs/DTOs, not dw.* API objects
[ ] Treat cache values as immutable snapshots; re-put updated copies
[ ] Design around TTL, not cross-node invalidation
[ ] Monitor hit ratios and write failures in Business Manager| Layer | What it caches | When to use |
|---|---|---|
| Page cache | Rendered responses / fragments | High-traffic pages where output can be cached |
Custom cache (CacheMgr) | Application data | Expensive computations, repeated DB lookups, third-party responses |
| Service response cache | HTTP responses inside service framework | Repeated calls to stable third-party APIs |
request.custom: per-request scratchpadsession.custom / session.privacy: per-user, per-session data (keep small)CacheMgr: app-server local cache shared by users on the same nodeNever store user-specific data in a global custom cache.
caches.json and register in cartridge package.jsonpackage.json that declares "caches" must live in the cartridge root (cartridges/{{mycartridge}}/package.json), and the caches.json path is relative to that.Prefer cache.get(key, loader) (single step). Avoid:
if (!cache.get(key)) cache.put(key, load())Don’t cache dw.catalog.Product, dw.order.Order, etc. Map to a lightweight object with only the fields you need.
Values returned by cache.get are immutable copies. Do not mutate them in-place. If you need to update cached data, write a new object back with cache.put(key, newValue).
Per-key invalidation across all nodes is unreliable. Design for a small staleness window using expireAfterSeconds.
If your third-party data is stable for short periods:
Key warnings:
dw.system.Cache (immutable copies + value constraints)dw.system.CacheMgr (cartridge package.json cache registration)~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.