Ship It Checklist

Checklists /Cloudflare /Security

High

Do not expose D1 or KV through an open API

A binding is not a public database. It becomes public if a route runs a query from the request with no auth check. Agents sometimes add /api/debug or pass the SQL string from the client.

How to check

  1. Search routes for prepare( and for any query built by string concatenation from user input.
  2. There should be no route that accepts raw SQL.
  3. Routes that read user rows should check the session first.
  4. Try the route signed out. Private data should not come back.

Prompt

Fix prompt
Paste into Cursor or Claude Code
You are working in this repository. Do not add features.

Goal: D1 and KV are only touched by server code that checks the caller, and no route accepts raw SQL.

Steps:
1. Find every env.DB and env.KV use, or the binding names this project actually has.
2. Remove any debug route that dumps a table.
3. Use bound parameters (?1) rather than string concatenation.
4. Check auth before returning private rows.
5. Tell me which routes still read the database and what they require.

This uses the same ticks as the checklist page, saved in this browser.

Related error fixes