free Risk Scanner · no signup

Find your runaway risks before they find you.

Run it on your own machine, or paste a read-only token here. Either way the scanner reads usage and settings, and nothing else.

fig. 01 · what the scan reads, hover or tap a node

Recommended

Run it locally

Your token goes straight to Cloudflare's API and nowhere else. See a sample first:

npx knsept scan --demo

Then scan your account with a read-only token:

CLOUDFLARE_API_TOKEN=… npx knsept scan

In your browser

Paste a read-only token

Permissions the token needs

Account Analytics Read
Workers Read
Queues Read
D1 Read

Create one in your Cloudflare dashboard under API Tokens. These are Cloudflare's read permissions, and the scanner only uses them to read usage and settings.

What it reads

Usage and settings for Workers, Durable Objects, Queues and D1. It never runs a D1 query, downloads your Worker code, or opens KV values or R2 files. These permissions would allow those D1 queries and code downloads, so if you'd rather keep the token on your machine, use the CLI.

What we keep

From a web scan, only how many times each rule fired. No token, account ID, resource name or query. How this works.