Skip to main content
← back to extensions

Cloudflare Audit

@webframp/cloudflare-auditv2026.10.21.1· Apache-2.0· 15d agoWORKFLOWSREPORTS
01README

Cloudflare security and configuration audit workflow. Inspects zone settings, DNS records, WAF rules, Workers, and cache configuration, then generates a severity-rated report with findings and recommendations.

Quick Start

swamp extension pull @webframp/cloudflare-audit

# Store the API token in a vault (prompts; never pass it inline)
swamp vault create local_encryption cloudflare
swamp vault put cloudflare API_TOKEN

swamp model create @webframp/cloudflare/zone cf-zone \
  --global-arg 'apiToken=${{ vault.get("cloudflare", "API_TOKEN") }}'
swamp model create @webframp/cloudflare/dns cf-dns \
  --global-arg 'apiToken=${{ vault.get("cloudflare", "API_TOKEN") }}' \
  --global-arg zoneId=ZONE_ID
swamp model create @webframp/cloudflare/waf cf-waf \
  --global-arg 'apiToken=${{ vault.get("cloudflare", "API_TOKEN") }}' \
  --global-arg zoneId=ZONE_ID
swamp model create @webframp/cloudflare/worker cf-worker \
  --global-arg 'apiToken=${{ vault.get("cloudflare", "API_TOKEN") }}' \
  --global-arg accountId=ACCOUNT_ID
swamp model create @webframp/cloudflare/cache cf-cache \
  --global-arg 'apiToken=${{ vault.get("cloudflare", "API_TOKEN") }}' \
  --global-arg zoneId=ZONE_ID

swamp workflow run @webframp/cloudflare-audit --input zoneId=ZONE_ID

Checks Performed

  • SSL mode (off/flexible/full/strict)
  • Always Use HTTPS enabled
  • Development mode disabled
  • Zone paused/active status
  • Firewall rules present and active
  • WAF managed rulesets enabled
  • DNS records proxied (origin IP exposure)
  • Dangling CNAMEs (subdomain takeover risk)
  • CAA records present
  • Worker scripts bound to routes
  • Cache level and hit rate
02Release Notes

2026.10.21.1

Changed: Documentation only: the README and the registry Quick Start now store the Cloudflare API token in a swamp vault (swamp vault put cloudflare API_TOKEN) and wire it with ${{ vault.get("cloudflare", "API_TOKEN") }}. The earlier examples passed a placeholder literal as apiToken, which invited pasting the raw token onto the command line.

Upgrade note: No code, workflow, report, or behavioral changes.

03Workflows1
@webframp/cloudflare-auditada3d8bb-9cde-436e-8bbc-7a45add10e8d

Cloudflare security and configuration audit. Inspects zone settings, DNS records, WAF rules, Workers, and cache config, then generates a severity-rated report with findings and recommendations.

zone-configGather zone-level settings and metadata
1.list-zonescf-zone.list— List all zones in the account
2.get-settingscf-zone.get_settings— Get zone settings (SSL, HTTPS, security headers)
securityGather WAF and firewall posture data
1.list-rulescf-waf.list_rules— List all firewall rules
2.list-packagescf-waf.list_packages— List WAF managed rulesets
3.security-eventscf-waf.get_security_events— Get recent security events
dns-and-edgeGather DNS records, Workers, and cache config
1.list-dnscf-dns.list— List all DNS records in the zone
2.list-workerscf-worker.list_scripts— List all Worker scripts
3.list-routescf-worker.list_routes— List Worker routes for the zone
4.cache-settingscf-cache.get_settings— Get cache-related zone settings
5.cache-analyticscf-cache.get_analytics— Get cache hit rate and bandwidth analytics
finalizeTrigger report generation after all data gathering completes
1.zone-detailcf-zone.get— Fetch zone detail for report context
04Reports1
@webframp/cloudflare-audit-reportworkflow
cloudflare_audit_report.ts

Analyzes Cloudflare zone configuration for security, DNS hygiene, WAF coverage, worker health, and cache performance

cloudflaresecurityaudit
05Previous Versions19
2026.10.14.1Apache-2.0(was none)

2026.10.14.1

Added: The manifest now declares license: Apache-2.0 (SPDX). The registry quality rubric scores a declared license separately from the bundled LICENSE.md.

Upgrade note: Metadata only. No code, schema, or behavioral changes.

2026.09.18.1

Upgrade note: Normalized npm:zod dependency version to 4.6.5 across the repo. No behavioral changes in this extension.

2026.09.18.1

2026.09.18.1

Upgrade note: Normalized npm:zod dependency version to 4.6.5 across the repo. No behavioral changes in this extension.

updated dependencies

2026.09.17.1

2026.09.17.1

Changed: Bump @webframp/cloudflare 2026.08.28.1 → 2026.09.15.1

2026.09.04.1

Changed: Bump @webframp/cloudflare 2026.08.26.3 → 2026.08.28.1

2026.08.28.2

Changed: Normalized the extension license to Apache-2.0 and corrected the copyright holder to "Sean Escriva". Extensions that previously shipped an MIT LICENSE.md are now Apache-2.0, consistent with the repository root and every other extension. No code or behavioral changes.

Upgrade note: License text only. No API, schema, or runtime behavior changed.

2026.08.28.1

Changed: Bump @webframp/cloudflare 2026.08.13.1 → 2026.08.26.3

2026.08.26.1

Changed: Normalized deno.json configuration for repo-wide consistency: added explicit compilerOptions.strict and migrated zod dependency to the import map (bare "zod" specifier instead of inline npm:zod@4.4.3). No behavioral changes — runtime resolution is identical.

updated dependencies

2026.09.04.1

2026.09.04.1

Changed: Bump @webframp/cloudflare 2026.08.26.3 → 2026.08.28.1

2026.08.28.2

Changed: Normalized the extension license to Apache-2.0 and corrected the copyright holder to "Sean Escriva". Extensions that previously shipped an MIT LICENSE.md are now Apache-2.0, consistent with the repository root and every other extension. No code or behavioral changes.

Upgrade note: License text only. No API, schema, or runtime behavior changed.

2026.08.28.1

Changed: Bump @webframp/cloudflare 2026.08.13.1 → 2026.08.26.3

2026.08.26.1

Changed: Normalized deno.json configuration for repo-wide consistency: added explicit compilerOptions.strict and migrated zod dependency to the import map (bare "zod" specifier instead of inline npm:zod@4.4.3). No behavioral changes — runtime resolution is identical.

updated dependencies

2026.08.28.2

2026.08.28.2

Changed: Normalized the extension license to Apache-2.0 and corrected the copyright holder to "Sean Escriva". Extensions that previously shipped an MIT LICENSE.md are now Apache-2.0, consistent with the repository root and every other extension. No code or behavioral changes.

Upgrade note: License text only. No API, schema, or runtime behavior changed.

2026.08.28.1

Changed: Bump @webframp/cloudflare 2026.08.13.1 → 2026.08.26.3

2026.08.26.1

Changed: Normalized deno.json configuration for repo-wide consistency: added explicit compilerOptions.strict and migrated zod dependency to the import map (bare "zod" specifier instead of inline npm:zod@4.4.3). No behavioral changes — runtime resolution is identical.

2026.08.28.1

2026.08.28.1

Changed: Bump @webframp/cloudflare 2026.08.13.1 → 2026.08.26.3

2026.08.26.1

Changed: Normalized deno.json configuration for repo-wide consistency: added explicit compilerOptions.strict and migrated zod dependency to the import map (bare "zod" specifier instead of inline npm:zod@4.4.3). No behavioral changes — runtime resolution is identical.

updated dependencies

2026.08.26.1

2026.08.26.1

Changed: Normalized deno.json configuration for repo-wide consistency: added explicit compilerOptions.strict and migrated zod dependency to the import map (bare "zod" specifier instead of inline npm:zod@4.4.3). No behavioral changes — runtime resolution is identical.

2026.08.25.1

2026.08.25.1

Changed: Updated labels for improved extension discoverability. Added cross-cutting category labels (security, observability, finops, infrastructure, networking, compliance, devops, ai, incident-response) where applicable.

updated labels

2026.08.24.1

2026.08.24.1

Added: Troubleshooting section documenting the silent allowFailure behavior producing false-healthy reports, hardcoded model instance name requirements, data-loading failure diagnostics, the 100-event workflow cap, and report output retrieval.

2026.08.21.1

2026.08.21.1

Fixed: The step-data loader silently swallowed failures when both the primary and fallback dataRepository.getContent calls failed for a step (empty catch block, no diagnostic). It now logs which step, model, and data name failed to load along with both underlying error messages, so a missing or malformed step output is visible in the report run's logs instead of silently producing a null and an unexplained "no data available" finding.

Upgrade note: No change to the report's output shape or findings logic — only added diagnostic logging on the failure path.

2026.08.15.1

2026.08.15.1

Changed: Bump @webframp/cloudflare 2026.07.18.2 → 2026.08.13.1

2026.07.24.1

Changed: Bump dependency pin:

  • @webframp/cloudflare 2026.07.18.1 → 2026.07.18.2

updated dependencies

2026.07.24.1

2026.07.24.1

Changed: Bump dependency pin:

  • @webframp/cloudflare 2026.07.18.1 → 2026.07.18.2

updated dependencies

2026.07.20.1

2026.07.20.1

Changed: Refreshed the dependency pin to the latest published release. No behavioral changes to the audit workflow or report.

Upgrade note: Bumps @webframp/cloudflare 2026.06.26.1 → 2026.07.18.1, pulled automatically with this extension.

updated dependencies

2026.07.18.1

2026.07.18.1

Changed: Version bump only, no code changes.

2026.06.26.1

Changed: Audit reports now include cache hit-rate and security event findings that were previously missing. The underlying cloudflare extension's GraphQL methods were silently failing — now that they work, the audit report produces complete results.

Upgrade note: Requires @webframp/cloudflare@2026.06.26.1. Pull both extensions together:

swamp extension pull @webframp/cloudflare
swamp extension pull @webframp/cloudflare-audit
2026.06.26.1

updated dependencies

2026.05.24.1

updated dependencies

2026.04.22.2
2026.04.22.1

updated platforms

2026.04.14.1
06Stats
A
100 / 100
Downloads
149
Archive size
13.9 KB
  • Has README or module doc2/2earned
  • README has a code example1/1earned
  • README is substantive1/1earned
  • Most symbols documented1/1earned
  • No slow types (deprecated)1/1earned
  • Dependencies pass trust audit2/2earned
  • Has description1/1earned
  • Platform support declared (or universal)2/2earned
  • License2/2earned
  • Verified public repository2/2earned
Repository
https://github.com/webframp/swamp-extensions
07Platforms
08Labels
#audit#cloudflare#compliance#dns#networking#security#waf