anolilab/lunora/lunora-cloudflare-audit

Lunora Cloudflare Audit

Diagnose from evidence: name the mechanism that spends money or breaks, point at the line, and prescribe the smallest fix. Lunora already ships three scanners, so this skill is mostly the order to run them in and the judgment they lack.

Recurring work (crons, queue consumers, workflows) has no public entry point, so check it before concluding costs are modest. If nothing metered is reachable from outside, traffic is modest and nothing recurs, say so and stop. Do not manufacture findings to fill a report.

Ground rules

• Evidence first. Every finding needs a file and line (or command output)

and a concrete Cloudflare mechanism. "Could be expensive" is not a finding.

• Prices and limits come from current docs, never memory. Name the meter

(DO requests, DO duration, SQLite rows read, D1 rows written, R2 Class A ops, Workers AI neurons, Browser duration, Vectorize queried dimensions, …) and fetch the current Cloudflare pricing/limits page before quoting a unit, an allowance or a cap. If you could not fetch it, say the claim is unverified.

• Do not infer account state from the repo. Alerts, WAF, cache rules, Access

and billing live in the dashboard. Without an export or screenshot, list that scope as _not inspected_.

• Confirmed vs suspected. A scanner hit is a lead. Confirm it against the

code path before it becomes a finding.

• Read-only. Never run lunora doctor --fix, deploy, or `cloudflare

alerts setup` from an audit. Show the change and get explicit approval first.

Workflow

1. Scope. Which wrangler environments (read each env.<name> block in

wrangler.jsonc or wrangler.json, the two files Lunora reads; the scan commands below take no --env), and which paths are hot: public queries/mutations, HTTP actions, crons, queue consumers, workflows.

1. Preflight signal (read-only; never pass --fix):

``bash lunora doctor --format json # wrangler bindings, paid products, sampling, DO class budget lunora advisor --format json --no-write # static lints, scored per procedure ``

lunora doctor reports paid-product-bound (a metered binding is declared: Workers AI, Browser, Images), observability-full-sampling, observability-query-unredacted (request logs or traces keep the ?token= in auth links), r2-lifecycle-unset, cpu-limit-missing and do-class-budget-*. lunora advisor lint ids are listed below.

1. **Runtime signal, only if the user points you at a worker that has served

traffic.** lunora insights (local by default). Production needs --prod and the user's admin token, plus --url … when the checkout has no production link; do not go looking for a token.

1. Account signal. lunora cloudflare alerts (status) reads last month's

usage and which products have a usage alert. Needs Cloudflare credentials; ask first. Budget alerts have no API, so they are always _not inspected_.

1. Trace the gaps in the next section by reading code.
2. Report in the format at the end.

What each signal already covers

Check this table before reading code by hand. Only the last column is yours.

Gaps to trace by hand

For each, find the call site, then count the billed units per user action.

• Fan-out without a cap. Promise.all(items.map(...)) or a loop that calls

ctx.db, ctx.runMutation, ctx.scheduler.runAfter, a queue send (ctx.queues.<name>.send / sendBatch) or ctx.ai once per element of user-sized input. Cap the batch or hand the list to a Queue/workpool with a concurrency limit.

• Retry storms. A retry (hand-rolled, queue maxRetries, workflow step

retry) around a call that is itself billed or rate-limited, with no backoff or circuit breaker. A workflow step that retries a paid ctx.ai call bills each attempt.

• Webhooks with side effects and no dedupe. An httpAction for a provider

webhook that writes or sends mail without keying on the event id. Providers redeliver. (Payment webhooks have their own lints; this is every other provider.)

• Preview / staging with paid bindings. An env.<name> block that binds

Workers AI, Browser, Containers or the production R2 bucket and is reachable without auth.

• Enumeration on hot paths. Storage enumeration through

ctx.db.system.query("_storage") or a Vectorize query (ctx.vectors.query) inside a query that every subscriber re-runs. (ctx.storage.list is action-only.)

• Third-party origins. An action that fetches a public serverless URL on

every request instead of caching, queueing, or using a service binding.

Public-path cost gate

Run this whenever an anonymous caller (an unauthenticated query, a public httpAction, a crawlable GET) can reach a metered product. The caller does not have to be a crawler: any script can repeat the request.