Vibe-Coding Hangover: Cloudflare Locks Workers by Default

AI has made it trivial for PMs, designers, and ops folks to vibe-code an internal tool and deploy it to the public Internet. Fast iteration is great. Accidentally exposing half-baked apps or company data is not.

Cloudflare’s announcement — Access for Workers — is basically: attach your company login gate to the Worker, not to every developer’s memory.

The old pain: you locked hostnames, not apps

Locking internal apps

Previously, Cloudflare Access lived at the hostname level. Every custom domain, route, workers.dev subdomain, and preview URL needed its own policy. Add a domain and forget to update Access? Wide open.

Preview URLs are the worst offender — each deploy can mint a new URL, and the faster you ship, the more leak windows you create.

Zero-trust access boundary

The new model: policy follows the Worker

You can now bind Access directly to a Worker (or flip a account-wide default):

Doesn’t matter how traffic arrives — custom domain, route, workers.dev, preview — authenticate first, then hit your code
Protect preview only, or every hostname
Account-wide private by default for all current and future Workers; bypass per Worker when something should stay public

Priority: hostname > Worker > account (most specific wins).

What developers should care about: `ctx.access`

Before: parse JWTs, verify signatures, extract claims yourself. Now, with Access enabled, every authenticated request carries ctx.access:

export default {
  async fetch(request, env, ctx) {
    if (!ctx.access) {
      return new Response("Access required", { status: 403 });
    }
    const identity = await ctx.access.getIdentity();
    const email = identity?.email ?? "unknown";
    return new Response(`Hello, ${email}`);
  }
};

Get email, name, and groups for personalization, authorization, or audit. Agents can use service tokens.

Local dev doesn’t require deploy-and-sign-in every time — mock identity in wrangler.jsonc:

{
  "access": {
    "dev": {
      "aud": "my-app",
      "identity": { "email": "admin@company.com" }
    }
  }
}

Internal platforms: one lock on the dispatch Worker

Edge workers and identity

With Workers for Platforms, set Access once on the dispatch Worker and every app in the namespace is private by default. Cloudflare open-sourced internal-sites-template — drag-and-drop deploys that stay behind login. Good fit for “everyone can vibe, not everyone gets the public Internet.”

Why this shipped now: FL2

This isn’t just product packaging. In the old stack (FL1, NGINX + Lua), Access ran before Worker logic. Targeting individual Workers required splitting routing from execution — risky when products share mutable pipeline state.

FL2, Cloudflare’s Rust-based modular edge proxy, uses strict phased modules with compile-time dependency checks. That made Worker-scoped Access a safe, gradual rollout instead of a scary NGINX surgery.

Practical playbook

Scenario	Suggestion
Company-wide internal vibe tools	Account default private; bypass only public production sites
Preview leaks only	Lock previews; keep production hostnames open
Solo side project, team-only beta	Single Worker + IdP — cheaper than rolling OAuth
Agents / automation	Service tokens

Bottom line

Vibe coding removed the “who can deploy” barrier. Secure-by-default has to move at product speed, not developer discipline. Access for Workers upgrades zero trust from “configure hostnames” to “configure apps” — a real ops win for anyone on Workers/Pages.

Docs: Cloudflare Access for Workers