Cloudflare Security reviews Cloudflare account configuration, Workers, Pages, D1, storage, APIs, DNS, TLS, origins, WAF, and deployment workflows. It uses authorized read-only account data and supplied code to produce evidence-backed findings, prioritized fixes, side-effect warnings, and verification steps. Customer support: https://thedoersfirm.com/support. It cannot guarantee complete security.
Install
- 1Add it in ChatGPT
Open Plugins in the ChatGPT sidebar (web or desktop), search for “Cloudflare Security” and select +. You'll be asked to sign in to any connected service on first use. Then type @ in a chat to call it.
Skills 12
- account-identity-hardening
Review Cloudflare account access, API-token scope, Access policies, and service credentials.
- cloudflare-security
Coordinate an evidence-based security review of Cloudflare accounts, applications, data, and deployment infrastructure.
- d1-data-access-security
Review D1 query safety, API exposure, authentication, tenant isolation, and data lifecycle controls.
- deployment-supply-chain
Review Cloudflare CI/CD, Git integrations, build credentials, environment separation, dependencies, and release controls.
- dns-tls-origin-security
Review Cloudflare DNS, DNSSEC, TLS, certificates, origin exposure, and tunnel configuration.
- headers-cors-cache-security
Review HTTP security headers, CORS, cookies, redirects, and cache isolation for sensitive responses.
- monitoring-incident-response
Assess security observability and guide response to Cloudflare account, token, application, or data incidents.
- secrets-and-api-leak-prevention
Detect unsafe secret storage, credential leakage, overprivileged API use, and sensitive-data logging.
- findings-remediation
Produce prioritized, evidence-backed security findings, remediation plans, and verification checks.
- storage-and-binding-security
Assess R2, KV, Durable Objects, Queues, Vectorize, and other Cloudflare storage or data bindings.
- waf-api-abuse-protection
Review Cloudflare WAF, API Shield, bot controls, endpoint exposure, and abuse/rate-limit defenses.
- workers-pages-security
Review Cloudflare Workers and Pages code, bindings, routes, previews, and application security boundaries.
Things to ask
- “Audit my Cloudflare setup using authorized read-only account data.”
- “Review this Worker and Wrangler configuration for security risks.”
- “Help me prioritize fixes for my Cloudflare-hosted app.”
Disconnect or uninstall
- 1In ChatGPT
Disconnect an account in Settings → Apps or Plugins. To remove the plugin itself, open Cloudflare Security in the Plugin Directory and select Uninstall plugin. Uninstalling can disconnect every account connected through it, and plugins your workspace installs may not offer the option.
- 2In Codex
Run /plugins in the Codex CLI, select the plugin and uninstall it, or press Space to turn it off.
Cloudflare Security alternatives
SuperpowersPlan, develop, and debug codeplugin · by Jesse Vincent · 294k stars