Question

A public API gets hammered with requests for resources that don't exist — scrapers and a misbehaving client repeatedly request random/deleted IDs. Each 'not found' lookup still queries the database (cache only stores hits), so the miss traffic saturates the DB. Design negative caching for this system: how you cache the absence of a value, how you bound the memory cost when an attacker enumerates infinite non-existent keys, how you avoid serving '404' for a key that gets created moments later, and the security angle.