Security Guidelines

  • Do not commit API keys, tokens, or production secrets. Use Cloudflare (or CI) environment variables for deploy-time secrets.
  • Review worker.js and wrangler.toml when changing origins, headers, or caching that could affect user safety or SEO.
  • For dependency or supply-chain concerns, prefer pinned versions in pyproject.toml / lockfiles and routine updates with changelog entries.