HSK
Edge Security

FlareGuard

Comprehensive security auditing tool for Cloudflare configurations that identifies misconfigurations and vulnerabilities in your setup.

Status
Open source
Since
Built with
JavaScript · Cloudflare API · Security Audit
Source
harshadk99/flareguard
View Repository

How it works

FlareGuard: audit pipelineA caller posts a zone ID and a Cloudflare API token to the FlareGuard Worker. The Worker loads a declarative baseline of 29 checks, and a dispatcher routes each check to one of nine evaluators: zone settings, WAF, DNSSEC, bot protection, rate limiting, Access, Workers, Page Shield and Logpush. The evaluators make read calls to the Cloudflare API. Findings are mapped to NIST SP 800-53 Rev 5 and CIS Controls v8 and scored with severity weights, and the report is returned with remediation and dashboard paths. Storage (KV cache, D1 history and drift, R2 reports, a queue for account-wide scans) is optional and off by default; the API token is never stored and IDs are hashed.AuditorPOST /api/audit/zonezone ID + API token/account audits every zoneFlareGuardCloudflare Worker · stateless by defaultbaseline.yaml29 checks, declarativedispatchercheck.service → evaluatornine evaluatorszone-settingwafdnssecbotrate-limitaccessworkerspage-shieldlogpushreadCloudflare APIzone settings · rulesetsDNSSEC · Access · WorkersPage Shield · Logpushcontrol mappingsNIST 800-53 r5 · CIS v8report builderweighted score 0–100Audit reportopen CRITICAL / HIGHremediation per findingdashboard path hintsJSON or web dashboardoptional bindings · off by defaultKV cache · D1 history + drift · R2 reports · Queue scansWeights: CRITICAL 10 · HIGH 5 · MEDIUM 3 · LOW 1; a WARNING earns half. The token is used per request and never stored; IDs are hashed.
Audit pipeline. One Worker reads a zone’s configuration through the Cloudflare API, checks it against a YAML baseline, and returns a scored report mapped to NIST and CIS controls. The Workers evaluator also flags zombie scripts and plain-text secrets.

Talks

All talks →

  1. The Edge Never Sleeps, and Neither Does Your Drift

    ACM/IEEE Austin Tech Talks · Austin, TX

    • Edge Security
    Event page

  2. Edge Never Sleeps: FlareGuard and Continuous Cloudflare Posture Validation

    BSidesPGH 2026 · Pittsburgh, PA

    • Edge Security
    Event Schedule

  3. Real-Time Edge Posture: Detecting Misconfigurations Before They Become Breaches

    ISACA Austin Chapter Annual General Meeting · Austin, TX

    • Edge Security
    ISACA Austin Chapter

  4. FlareGuard: Automating Security Posture at the Edge

    Cloudflare Workers Tech Talks · Austin, TX

    • Edge Security
    Event Writeup

  5. FlareGuard Edge: Serverless Posture at the Edge

    BSides SWFL 2025 · Fort Myers, FL

    • Edge Security
    Event ScheduleSpeaker Page

Elsewhere

  1. Cloudflare Workers Tech Talks — FlareGuard: Automating Security Posture at the Edge

    Independent writeup by Nick Gray from Austin's first Cloudflare Workers Tech Talks, where Harshad presented FlareGuard alongside Cloudflare's own engineers — including Kenton Varda (founder of Cloudflare Workers). Nick documented three key insights from the talk: the invisible risk of edge misconfigurations (exposed .env vars, outdated TLS), FlareGuard's Gold Standard YAML baseline approach to auditing every Worker, and the Shadow IT Fix — automatically detecting zombie workers that become attack entry points.

    Read on nickgray.net →

Connect With Me

All contact methods in one place

Email
[email protected]
Location
Austin, Texas
LinkedIn
linkedin.com/in/harshad99
GitHub
github.com/harshadk99