Skip to content

Security

Jump to bottom
Kritarth-Dandapat edited this page Jul 19, 2026 · 1 revision

Security

FreeFlow's trust model: whoever holds SECRET_API_KEY can publish arbitrary HTML to your domain, and anyone with a draft URL (plus PIN, if set) can view it. That's a small, honest surface — but a few gaps are open and tracked.

Threat model

  • SECRET_API_KEY is the only write-path auth. Treat it like a root credential — anyone with it can serve arbitrary content (including script) from your domain.
  • Draft URLs are bearer capabilities. No PIN = anyone with the link can view. This is by design (unlisted, not private) unless --secure <pin> is used.
  • PIN is not strong auth — short numeric PINs, no rate limiting on guesses at GET /d/:id.

Known gaps — tracked in issue #2

  1. Stored XSS by design — uploaded HTML is served raw as text/html, no Content-Security-Policy, no X-Frame-Options. Anyone with the API key can host arbitrary script on the Worker's domain.
  2. PIN leaks via URL — sent as ?key= query param, landing in browser history, access logs, Referer headers. Stored as plaintext in KV.
  3. No TTL / no delete endpoint — drafts live in KV forever.
  4. No upload size limit — arbitrarily large html accepted; fails late against the 25MB KV value cap.
  5. No rate limiting on /upload — a leaked key can spam-fill KV with no throttling.
  6. Guessable draft IDs — 8 hex chars, small keyspace, enumerable for unlisted (non-PIN) drafts.
  7. Swallowed errors — top-level fetch catch returns bare 500, no server-side logging.
  8. CLI has no local file size guard — large local files read fully into memory before upload.

A GitHub Copilot coding agent is assigned to issue #2 to land fixes for all of the above (CSP/XFO headers, PIN off the URL, TTL + delete endpoint, upload size cap, rate limiting, wider ID entropy, error logging, CLI size guard).

Operational recommendations (until the above lands)

  • Rotate SECRET_API_KEY if you suspect it leaked.
  • Don't publish drafts containing secrets or PII — there's no encryption at rest beyond Cloudflare's platform defaults, and no delete path yet.
  • Don't rely on the PIN for anything beyond casual link-sharing friction — it is not a substitute for real access control.
  • Keep wrangler.toml (holds account/namespace IDs) out of version control — it's already git-ignored.

Repository-level protections in place

  • master branch: force-push and deletion blocked (no required status checks yet — no CI configured).

Related

Clone this wiki locally