Deploy to Cloudflare button: a way to mark .dev.vars.example entries optional

[ddyy]

What happens now

The Deploy to Cloudflare button reads .dev.vars.example and prompts the deployer for every uncommented entry as a required secret, deploying each value with the Worker. There's no way for a template author to say "this one is needed to boot, the rest are add-later."

Why it's a problem

.dev.vars.example is, for most projects, a local-development template. It often contains dev-only conveniences and placeholder values that are fine locally but wrong (or dangerous) in production. Because the button treats every entry as a required deployed secret with the example value pre-filled, those local defaults get shipped to production by deployers who accept the suggestions.

Concrete failure from a real project (Minvoice, an OSS invoicing app on Workers): the example file contained DEV_BYPASS_ACCESS=true (skips admin auth locally), APP_BASE_URL=http://localhost:8787, and placeholder Stripe/PayPal keys. One-click deploys therefore shipped with admin auth disabled, localhost links in emails/PDFs, and payment buttons wired to placeholder keys. Writeup: https://daniel-yang.com/writing/cloudflare-deploy-button-disabled-auth/

Proposed fix

Any one of these would solve it:

1. Skip commented entries as the documented convention (many templates already comment optional entries; formalizing "commented = not prompted" requires no new syntax). This is what I reverse-engineered as a workaround.
2. An optional-marker in the example file (e.g. a # optional annotation, or a separate .dev.vars.optional.example).
3. Support the existing cloudflare.bindings metadata in package.json as the source of truth for which secrets to prompt, with per-entry required.

Impact

Every Workers template with a deploy button and local-dev conveniences in its example file is exposed to the same class of misconfiguration. A clear optional/required distinction turns a footgun into a guided setup.

Related

Same deploy-button import/config surface as #14553. Companion docs request: cloudflare/cloudflare-docs#31988; a documented warning is the faster interim fix even before this feature lands.