Only the latest release receives security fixes.
| Version | Supported |
|---|---|
| Latest | yes |
| Older | no |
Do not open a public issue for security vulnerabilities.
Use GitHub's private vulnerability reporting:
- Go to the Security tab of this repository.
- Click "Report a vulnerability".
- Describe the issue, steps to reproduce, and potential impact.
Security issues relevant to this project include:
- Credential exposure — scoped API tokens or created tokens being leaked through logs, error output, process arguments, or environment variable handling.
- Token scope creep — the tool granting broader permissions than the user selected due to a logic error in scope resolution.
- Denial of service — pathological parsing of untrusted Cloudflare API responses or user-provided input causing the CLI to hang or degrade severely.
- Command injection — user-supplied input being passed unsafely to shell commands or the Cloudflare API.
- Supply chain — a dependency being resolved to a malicious package with the same name.
- Insecure token storage — tokens being written to disk or exposed in a way the user did not intend.
Issues in third-party dependencies should be reported directly to the upstream maintainer. If the vulnerability is only exploitable through create-cf-token, please report it here as well.
- Vulnerabilities that require physical access to the machine running the tool.
- Theoretical issues with no practical attack path.
- General best-practice suggestions not related to a specific vulnerability.
- Issues with the Cloudflare API itself — report those to Cloudflare.
We follow a coordinated disclosure model. Please allow us the agreed remediation window before publishing details publicly. We will credit reporters in the release notes unless anonymity is requested.