cloudflare-workers-securitylisted

# Cloudflare Workers Security Audit Audit a Cloudflare Workers application. Workers run in V8 isolates with specific platform bindings — security surface is partly app code, partly Cloudflare configuration. ## When this skill applies - Reviewing `wrangler.toml` / `wrangler.jsonc` config - Auditing binding usage (KV, D1, R2, Durable Objects, Queues) - Reviewing secret vs var declarations - Checking Worker routes and zone configuration - Auditing request handling for SSRF / data leakage ## Workflow Follow `../_shared/audit-workflow.md`. Companion: framework skill (`hono-security`, `nextjs-security`) for code-level concerns. ### Phase 1: Stack detection ```bash ls wrangler.toml wrangler.jsonc 2>/dev/null cat wrangler.toml wrangler.jsonc 2>/dev/null wrangler --version 2>/dev/null ``` ### Phase 2: Inventory ```bash # Bindings declared in wrangler.toml grep -nE 'kv_namespaces|d1_databases|r2_buckets|durable_objects|queues|vars|secrets' wrangler.toml 2>/dev/null # Binding usage in code grep -rn 'env\.\|c\.env\.' src/ # Fetch calls (potential SSRF if URLs are user-controlled) grep -rn 'fetch(' src/ | head ``` ### Phase 3: Detection — the checks #### Secrets vs vars `wrangler.toml` `[vars]` section is committed and visible in the dashboard. Secrets go via `wrangler secret put`. - **CFW-SEC-1** No production secrets in `[vars]`. Audit `wrangler.toml`: ```toml [vars] API_BASE_URL = "https://api.example.com" # OK, public STRIPE_SECRET_KEY = "sk_live_..."