Repository navigation
MANUAL RUN: free Cloudflare protections for codeSplitters (WAF, bots, auth rate-limit rule, Access on admin, Turnstile key) #653
Description
Found in the security audit (notes/SECURITY_AUDIT.md). Free Cloudflare protections for the live codeSplitters site that are dashboard switches, not code:
- WAF managed rules (Security → WAF → Managed rules): the free managed ruleset is on by default for proxied zones. Check it's on for the codeSplitters domain.
- Bot Fight Mode (Security → Bots): on. Skip it if it blocks MCP clients or the CLI; then use a WAF custom rule to skip
/api/*and/mcpwith a bearer. - A rate limiting rule (free plan: 1 rule, 10s window) on
/api/auth/*, e.g. 20 requests / 10s per IP → block. It sits in front of the Worker, so no D1 writes. - Cloudflare Access (Zero Trust, free up to 50 users) on the admin paths (
/admin*,/api/admin*) with a one-time PIN toADMIN_EMAILor GitHub login. A stolen admin session then still needs the Access login. A small code change may be needed for the API paths' JSON clients; do the UI path first. - Turnstile: create a widget for the domain (free) and put the secret into 1Password at
op://codesplitters/turnstile/secretso the Turnstile code change can read it through varlock. - Notifications (Notifications → Add): "Security Events Alert" and "Workers usage" to your email, and API token audit: list tokens at dash.cloudflare.com/profile/api-tokens and delete stale ones; check the drops token is R2-only on
rustybuns-drops.
Check: each step's page shows it on; the auth rate-limit rule blocks a for i in $(seq 30); do curl -s -o /dev/null -w '%{http_code}\n' https://<site>/api/auth/get-session; done burst with a 429 near the end.
Activity
QuinnsCode commentedon Oct 11, 2026
11 Oct: Turnstile widget made, secret at
op://codesplitters/turnstile/secret, site key in #720. A $10 billing budget alert emails the owner. API tokens reviewed (kept "Cloudflare Agent Token - 2026-06-24", recently used).Skipped: WAF managed rules, Bot Fight Mode, the
/api/auth/*rate-limit rule and Access on/admin*all need a zone the account owns. codeSplitters is served from workers.dev, so they'd need a custom domain first. Leaving this open for that decision.QuinnsCode commentedon Oct 11, 2026
Walk-through 2026-10-11, done with the owner in the dashboard.
Blocked: needs a custom domain. codeSplitters is served from
codesplitters.notryanquinn.workers.dev, and these settings only apply to a domain of your own:/api/auth/*/admin*,/api/admin*Done
op://codesplitters/turnstile/secret. The form went through twice, so there are twocodesplitterswidgets (site keys…TxsbLsHzvigdzXand…TyaxcLpAqRT0pg). When the Turnstile code change is built, use the one whose secret matches 1Password and delete the other.codesplitters-usage-alert1(billing budget alert, email).FlareUp×3,staticflare-bootstrap×2.Leaving this open as a manual run until codeSplitters is on a custom domain.
QuinnsCode commentedon Oct 11, 2026
Done with what can be done on workers.dev (see the comment above). The steps that need a custom domain moved to #722.