# Cloudflare Worker Security Review

> Cloudflare Worker Security Review is a paid API for AI agents from x402-hono-api.inraby.workers.dev, paid per call via x402, $0.1/call, status unknown (last checked 2026-09-14).

Analyzes Cloudflare Worker JavaScript/TypeScript source (and optional wrangler.toml) for security vulnerabilities including hardcoded secrets, unsafe CORS, missing admin auth, sensitive logging, and dynamic code execution.

## Facts

- Endpoint: POST https://x402-hono-api.inraby.workers.dev/api/v1/cloudflare-worker-security-review
- Price: $0.1/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/cloudflare-worker-security-review-f035f48a
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_CQGCNXM88HpIG7bNa9q-X

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability cloudflare-worker-security-review-f035f48a -d '<json body>'
```

Example prompt: Can you do a security review of this Cloudflare Worker source code and flag any hardcoded secrets, unsafe CORS settings, missing admin auth, sensitive logging, or dynamic code execution risks? Here's the worker code: [paste Worker JS/TS here]

## When to prefer this

Use this endpoint when you need a focused, automated security review specifically for Cloudflare Workers code — it understands Worker-specific patterns like wrangler.toml secrets, Cloudflare-specific CORS handling, and Workers runtime APIs. Prefer this over general code scanners when deploying Workers to production or reviewing Worker PRs.

## Known failure modes

- Empty or missing workerCode field returns validation error
- Malformed JavaScript/TypeScript that cannot be parsed may return partial results
- Very large Worker files may hit payload size limits
- Non-Worker JavaScript may produce irrelevant findings
- Payment failure returns 402 response requiring x402 protocol payment

## How this service works

Review Cloudflare Worker source and optional wrangler.toml for hardcoded secrets, unsafe CORS, missing admin auth, sensitive logging, and dynamic code execution.

## Output

A structured security audit report identifying vulnerabilities in the Worker source code across categories: hardcoded secrets, unsafe CORS configuration, missing admin authentication, sensitive data logging, and dangerous dynamic code execution patterns, with remediation guidance per finding.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "workerCode": {
   "type": "string",
   "description": "Worker JavaScript/TypeScript source"
  },
  "wranglerToml": {
   "type": "string",
   "description": "Optional wrangler.toml contents"
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/cloudflare-worker-security-review-f035f48a/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from x402-hono-api.inraby.workers.dev](https://www.zero.xyz/host/x402-hono-api.inraby.workers.dev/llms.txt)