cloudflare / cloudflare/cloudflare-docs

Deploy button docs should warn that .dev.vars.example becomes a production secret prompt

Open
#31,988 1 comment 0 reactions 6 assignees Claimed by @WalshyDev View on GitHub
content:edit documentation product:workers stale
Dominant language
MDX
Stars
5.2k
Forks
16.7k
Avg merge
2d 6h
Merged PRs (30d)
337

Description

### Existing documentation URL(s)

https://developers.cloudflare.com/workers/platform/deploy-buttons/
https://developers.cloudflare.com/workers/configuration/secrets/

### What changes are you suggesting?

## Request

The Deploy to Cloudflare button documentation should state clearly, near the top, that **every uncommented entry in `.dev.vars.example` is prompted as a required secret and deployed to production**, and that template authors should therefore treat that file as an installer prompt rather than a local-dev scratchpad.

## Why

`.dev.vars.example` is conventionally an inert template: nothing reads it directly. Developers copy it to a gitignored `.dev.vars` and edit the copy. Authors therefore pre-fill it with dev-friendly suggestions (bypass flags, localhost URLs, placeholder keys) expecting a human review-and-edit step between the template and anything that executes. The deploy button removes that step: it promotes the template's values straight into live production secrets. That has caused real misconfigurations, including a shipped auth bypass (`DEV_BYPASS_ACCESS=true` deployed to production) and localhost URLs baked into deployed apps. Writeup: https://daniel-yang.com/writing/cloudflare-deploy-button-disabled-auth/

## Suggested wording (docs snippet)

> **Heads up:** the Deploy button prompts for every uncommented line in your `.dev.vars.example` and stores each as a Worker secret. Treat this file as your app's setup prompt: keep only the variables a first deploy genuinely needs uncommented, comment out local-dev conveniences and optional integrations, and never include values (like auth-bypass flags or localhost URLs) that would be unsafe in production.

## Related

Companion to the feature request for an optional-secrets mechanism in cloudflare/workers-sdk: https://github.com/cloudflare/workers-sdk/discussions/14639. Even without that feature, this warning prevents the next occurrence.

### Additional information

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.