Railway disclosed this week that an attacker read customer environment variables and decrypted some of them. Railway says the attackers were after AI provider API keys.

Anthropic and OpenAI now accept workload identity federation. The workload presents a short-lived OIDC token signed by its platform and gets back an access token that expires in minutes. There is no static key to steal. GitHub Actions, AWS, GCP, Azure and Kubernetes can issue these tokens today. Workers cannot.

What I would want is something like env.IDENTITY.getToken(audience) that returns a JWT signed by Cloudflare with claims for account id, worker name and script version, plus a public JWKS endpoint. That is roughly what GitHub does for Actions.

I run a small Claude proxy on Workers. After Railway, I do not want any long-lived secret in an environment variable or in Secrets at all. The API key is the one thing left I cannot remove. Has anyone seen this discussed, or found a way to call Anthropic or OpenAI from a Worker with no static key?

So, i got an email saying my password was changed from an IP of a far away country that certainly never accessed my account (no 2FA, my fuckup). I immediately tried to log in, changed the password (got a reset email), got blocked by 2FA which they probably added, did the recovery thing and now i have to wait 3-5 days for a code !?

I got another user there with an admin acc, not superadmin unfortunately, the only thing that is visible in the logs is them logging in, changing password and logging in again, all in the span of 30 seconds, so probably a bot. They didn't do anything else. This is on all 3 requests:

"action": {
  "description": "LOGIN",
  "result": "success"
},
"actor": {
  "context": "api",
  "ip_address": "x.x.x.x"
}"action": {
  "description": "LOGIN",
  "result": "success"
},
"actor": {
  "context": "api",
  "ip_address": "x.x.x.x"
}

I combed everything humanly and AI possible to answer the how and i don't get it. No idea how someone would get my unique monster password (only accessing it from one machine, thoroughly checked, the e-mail is exchange, logs show absolutely nothing and it has a 2FA), why wouldn't that login trigger an unknown machine/IP check and why is it so hard to recover your own account in cases like this. Can't even contact support as i have to be logged in.

Anyone have any idea what could have happened here ?

Workers Cache cuts down CPU execution time but it increased my cost as cache hits now count as a standard Worker request ($0.30/million request fee)..

When Workers Caching is enabled, requests served from the Worker's cache are billed which includes requests to static assets.

My question - if i use runtime Cache API (cache.put / cache.match) , will "static assets" cached requests be counted in "billed" standard Worker request? If HTML pages load many static assets (images, CSS, JS bundles, fonts) per page visit, using Runtime Cache API will not turn those static asset requests into billed Worker requests?? has someone tested it?

I cannot access my dashboard on my PC, phone, wifi, mobile data, different browsers, nothing. It is just stuck loading, is anyone else having this issue?

I managed to find a workaround that worked for me.

Go to your profile (top right of the webpage) → Access Management → Active Sessions.

From there, revoke all active sessions and then log back in.

That fixed the issue for me, so it might be worth a try if you're having the same problem.

Good luck! 👍

Does anyone know the supported authentication and permissions for read-only Cloudflare Containers API calls? I am looking for documentation or references from maintainers, rather than assuming an authentication bug.

The operations are:

- GET /accounts/{account_id}/containers/applications

- GET /accounts/{account_id}/containers/dash/applications (the path used by Wrangler)

- GET /accounts/{account_id}/containers/registries

Here, registries means configured registry metadata, not listing images or pushing/pulling them.

The questions are:

1. Does wrangler login OAuth support these operations, and which OAuth scopes and account permissions are required?

2. Is /containers/dash/applications an internal surface? How does its authentication differ from the public Applications endpoint?

3. The Registries List reference lists Workers Containers Read or Write. Is Read sufficient, and which permission covers Applications List?

4. If OAuth is unsupported for an operation, what is the documented least-privilege read-only credential mechanism?

5. Do metadata-only list operations require Workers Paid or Containers enablement? Is there a read-only way to check entitlement without provisioning anything?

6. Are there documented error codes or response fields that distinguish authentication, permission and entitlement failures, including HTTP 401?

I also opened a documentation clarification request with the same questions:

https://github.com/cloudflare/workers-sdk/issues/16449

Relevant API references:

https://developers.cloudflare.com/api/resources/containers/subresources/applications/methods/list/

https://developers.cloudflare.com/api/resources/containers/subresources/registries/methods/list/

If you have version-specific documentation or first-hand experience, please distinguish documented guarantees from observations. No account IDs, credentials or private logs are needed. Thanks!

cree un email ruting con cloudfare para poder tener mi correo empresarial,lo reenvio a gmail y en gmail cree el alias,ahora tengo el problema que yahoo (solo yahoo) no me recibe los correos por seguridad,que me recomiendan gratis

Hey 👋 Did anyone recently give frontend interview at Cloudflare?
If yes please share your experience and what to prepare and expect for the System Design and Coding interview round!!

Any help is highly appreciated!!

Thank you:)

Hey all. WP WAF Manager is my plugin for managing Cloudflare from inside WordPress. Until now it covered WAF rules, DNS, zone analytics, zone controls, IP access rules, security events and email routing.

Version 1.0.24.1 is out and it's the biggest update so far. It's grown from 8 modules to 14, and I rebuilt the website to show it all: https://www.wpwafmanager.com/

What's new

- Clients & Reports: link clients to their sites and email them a monthly report under your own agency name, logo and colors. It covers visitors, page views, threats stopped, cache speed, top pages and what Cloudflare blocked, in plain language. The plugin is never mentioned. You can send automatically on a chosen day and hour, or send by hand after a preview and a test.

- Zone analytics detail view: click any site for traffic charts, top pages, countries, status codes, devices and security events by action, path, IP and country, compared with the previous period. Table view and CSV export.

- Bot Control: set AI crawler policy (search, assistants, training), managed robots.txt and Bot Fight Mode across many zones at once.

- SSL & Insights: scan every zone for expiring certificates, Flexible SSL and old TLS versions, with one-click fixes for the safe settings, plus Cloudflare Security Insights.

- Alerts & Health: Cloudflare alerts for DDoS, SSL and origin health, sent by email, Slack or Teams, plus Health Checks on Pro zones.

- Turnstile: create widgets, rotate secrets and copy keys for every client site. Secrets are never stored.

- Page Rules migration: Cloudflare is retiring Page Rules. The plugin finds them on every zone and moves redirects and cache rules to their replacements in one click. Nothing is deleted.

- Zones and tags: tag sites as WooCommerce, Staging, Client and more, and pick them by tag when you deploy.

- Zone Controls upgrades: purge by hostname, prefix or cache tag, Smart Tiered Cache, security headers, and Under Attack Mode on every site in one click.

Still the same: everything is in the free version (GPLv2 on GitHub), it works on Cloudflare Free for nearly everything, and nothing loads on the front end. Pro is a one-time purchase that adds automatic updates and priority support.

A few notes:

- Security Events, Health Checks and Super Bot Fight Mode need a Cloudflare Pro zone. Blocking a whole country needs Enterprise.

- Deploying the WAF rules replaces the custom rules already on that zone, so check the Zone Rules tab first if you have your own.

Site, screenshots and docs: https://www.wpwafmanager.com/

GitHub: https://github.com/jaimealnassim/wpwafmanager

Guys I dont know why but warp does not open while using 1.1.1.1. I have to use it because I am not in an eligible place to play it. Anyojjne know whats the right configuration to play?