Hardening checklist

Go through this list once after turning on Cloudflare Access.

• Cloudflare Access protects the whole Worker, with a policy that names your email addresses, not “everyone”.
• ALLOWED_EMAILS lists the same email addresses as a second lock.
• DEV_USER_EMAIL is not set in production. It is ignored there, but there is no reason to set it.
• If /api/v1 uses a Bypass policy, a Cloudflare rate-limiting rule covers /api/v1/*. One rule is available on the free plan.
• Tokens have an expiry and the narrowest scope that works. Revoke the ones you no longer use.
• Your passphrase is long (a sentence of five or more words), and the recovery code is stored somewhere separate from it.
• You pull releases regularly. About and updates in the app tells you when one is out.

What a token can do

	Read token	Write token	Web session
Download ciphertext and wrapped keys	✓	✓	✓
Create, update, trash or delete notes		✓	✓
Change the passphrase			✓
Create or revoke tokens			✓

Tokens are accepted only on /api/v1, never as cookies. The web app’s /api routes accept only a Cloudflare Access session.

To report a vulnerability, follow SECURITY.md.