You'd be trusting a small company with a view into your Cloudflare account. So Guard is built to need as little as possible, and the parts that act run in your account.
npx knsept scan sends your token to api.cloudflare.com and nowhere else. It has no telemetry, and the report stays on your screen.
The token is sent to our API over HTTPS, held in memory for one request, and discarded. It is never written to a database or a log, and every log line passes through a redaction step first.
How many times each rule fired, and when. No token, account ID, Worker name, database name or SQL.
The scanner never runs a query against your D1 databases and never downloads your Worker code. Query text comes from Cloudflare's analytics, with bound values already left out.
These permissions reach further than the scanner goes: Cloudflare accepts D1 Read for running queries, and Workers Read can download Worker code. If you'd rather not paste that into a website, run the CLI, which sends your token only to Cloudflare.
The watcher and the Brake Worker run under these rules.
Without the Brake Worker, Guard can only alert you.
The Brake Worker is open source and deployed by you. It holds the only token that can pause a queue. Knsept never holds a token that can change your apps.
The Brake Worker acts only on a signed, recent request for a resource and action you listed in its config.
Connected accounts' tokens are encrypted before they reach the database, with the narrowest read-only scopes. A token is deleted when you disconnect the account or your subscription ends. Guard keeps 30 days of usage per resource, by name, and the latest findings, with the values taken out of any SQL they quote. Alert emails name the resource and its spend, and go only to the address you sign in with.
Queues first: Cloudflare has a setting that pauses a queue's delivery. Durable Object alarms run inside the object, and Cloudflare offers no way we've found to cancel one from outside. Until there's a safe way to stop a resource, Guard alerts you and leaves it running.
Email support@knsept.com with "Security report" in the subject.