Security Deployment

Security and Deployment

Use this skill before shipping a Cloudflare Worker or modifying production bindings.

Security stance

• Bindings are capabilities. Give each Worker only the bindings it needs.
• Keep secrets out of source control and wrangler.jsonc.
• Authenticate at the Worker boundary; authorize inside every data/tool operation.
• Validate all request input, queue messages, workflow parameters, WebSocket messages, and AI tool calls.
• Include tenant ID in every multi-tenant data access path.
• Avoid arbitrary user-controlled outbound fetches unless SSRF risk is explicitly addressed.

Secrets and config

• Use vars only for non-secret values.
• Use wrangler secret put NAME or a secret binding for credentials.
• Rotate secrets through deployment runbooks.
• Do not echo secrets into logs, error responses, AI prompts, or queue messages.

Authz helper pattern

type Principal = { userId: string; tenantId: string; roles: string[] };

function requireTenant(principal: Principal, tenantId: string) {
  if (principal.tenantId !== tenantId) {
    throw new Response("Forbidden", { status: 403 });
  }
}

CORS rules

• Do not use * for credentialed APIs.
• Keep an allowlist of origins per environment.
• Return CORS headers consistently for preflight and actual responses.
• Validate auth even when CORS permits the origin.

Deployment checklist

• wrangler.jsonc has correct environment-specific bindings.
• Generated types are up to date.
• Migrations are tested and ordered.
• Durable Object migrations are append-only.
• Secrets are present in target environment.
• Observability is enabled before rollout.
• Rollback or traffic-disable plan is written.
• Production smoke test covers a real binding call.

Migration/deployment ordering

For schema changes:

1. Expand: deploy additive schema.
2. Deploy code that can read/write old and new shape.
3. Backfill or migrate asynchronously.
4. Switch reads to new shape.
5. Contract: remove old columns/tables only after verification.

AI/tool security

• Treat model output as untrusted.
• Validate tool arguments generated by the model.
• Enforce authorization in tools, not prompts.
• Do not include secrets or unrelated tenant data in prompts.
• Require confirmation for destructive/expensive actions.

Anti-patterns

• One Worker has every binding because it is convenient.
• Preview environment points at production D1/R2/KV by accident.
• Authorization enforced only in the frontend.
• Queue consumers trust messages without schema validation.
• Raw internal errors are returned to users.