Note: this isn't caching the asset itself, just the json metadata about the asset.  There's a separate asset-serving path in the app that will never serve an asset unless it's been scanned as clean.

I think it's fine to cache this response because the metadata isn't going to change quickly (unlike in the case when the asset has yet to be scanned).