Please report security issues privately via GitHub's "Report a vulnerability" (Security → Advisories) rather than opening a public issue. We aim to respond within a few days.

headflare is designed so that no secret or sensitive user data is ever stored by the application:

• Credentials live only as secrets. Your CF_ACCOUNT_ID and CF_API_TOKEN are Cloudflare Worker secrets in production (wrangler secret put …) and, for local development, live in .dev.vars — which is gitignored. They are never written to the database, logs, or any committed file.
• The API token is read-only and scoped. It only needs Account Analytics → Read; it cannot modify your Cloudflare account.
• All Cloudflare calls are server-side. Every request to the GraphQL Analytics API runs inside a TanStack Start server function on the Worker. The token is never sent to, or exposed in, the browser.
• The database stores only aggregate usage numbers. D1 holds daily usage counts and projection snapshots per metric (e.g. "Workers requests on 2026-06-28 = 91,234"). It contains no credentials, no request contents, and no personal data.

If you fork or deploy headflare, keep these properties: don't commit .dev.vars, don't log the token, and keep the token's scope minimal.