Ship It Checklist

Checklists /Cloudflare /Security

Critical

Store secrets with Wrangler, not in wrangler.jsonc

wrangler.jsonc is committed. Vars in that file are not secret. API keys, webhook secrets and database passwords belong in Wrangler secrets, or in .dev.vars locally, which stays out of git.

How to check

  1. Open wrangler.jsonc. The vars block should contain only public configuration, such as a site URL or a feature flag.
  2. Search the repo for live key prefixes. There should be none.
  3. Confirm .dev.vars is gitignored, and .dev.vars.example has names only.
  4. For production, the secret should be set with wrangler secret put, not pasted into the dashboard as a plain var you then copy into the repo.

Prompt

Fix prompt
Paste into Cursor or Claude Code
You are working in this repository. Do not add features.

Goal: secrets are read from the Worker env and are not written in wrangler.jsonc or source.

Steps:
1. Search for keys and passwords in the repo and in wrangler config.
2. Move public values to vars. Leave secret names out of the file.
3. Read secrets from env in the Worker. Document the names in the README and in .dev.vars.example with empty values.
4. If a real secret was committed, tell me to rotate it and to set the new value with wrangler secret put. Do not print it.
5. Confirm .dev.vars is gitignored.

This uses the same ticks as the checklist page, saved in this browser.

Related error fixes