You left out the part about how you use them as a reverse proxy, which is decoupled from DNS. One is coincidental; the other required.

If they can inject script, they can also snoop on all your cleartext traffic without you knowing....

▲

stagas 25 minutes ago | parent | next [-]

Oh gosh I didn’t enable anything like that also. I just wanted the nameservers in order to serve the bucket under my subdomain. What else is there I wonder?

	▲	stagas 12 minutes ago \| parent [-]
		Ok to turn this off you go Domains → Overview → your.site → DNS → Records → then Edit each entry to DNS Only (gray cloud). MITM gone now (I hope).

▲

johntash 43 minutes ago | parent | prev [-]

Indeed. I have several domains using cf for dns only and they don't/can't inject anything into those sites.