infisical

name	infisical
description	Manage the Air Con for the Vulnerable Website deployment secrets through its dedicated Infisical project without exposing or broadening credentials.

Infisical: Air Con for the Vulnerable Website

Scope

This repository is linked in .infisical.json to the dedicated Air Con for the Vulnerable Website secret-manager project in Infisical EU Cloud. Its project ID is 4cf95ea0-9eec-4d46-af1e-fc07f5c0d239. Do not switch the repository back to a shared/general-purpose project.

The Cloudflare deployment credentials belong only in:

environment: prod
path: /cloudflare/deploy
secret names: CLOUDFLARE_OAUTH_TOKEN, CLOUDFLARE_OAUTH_REFRESH_TOKEN,
              CLOUDFLARE_OAUTH_EXPIRATION_TIME, CLOUDFLARE_OAUTH_SCOPES

This project currently uses a renewable Wrangler OAuth credential because a user API token with the required site-only scope is unavailable. It is account-wide and must remain only in Infisical; it is never committed or exported to a local .env file. Replace it with a least-privilege API token after moving the Worker and zones to a dedicated Cloudflare account.

Prerequisites

Install the Infisical CLI, then authenticate against EU Cloud:

infisical login --domain https://eu.infisical.com

.infisical.json is safe to commit. Credential files and exported secrets are not.

Normal use

Run a process with scoped production deployment secrets injected only into that process:

infisical run --env=prod --path=/cloudflare/deploy -- npm run deploy:cloudflare

The repository shorthand is npm run deploy.

To rotate the OAuth credential, first run npx wrangler login, then use a secure, non-logged automation to update the four credential values in the configured Infisical path. Do not print, export, or paste their values into chat, source, or shell history.

infisical secrets set CLOUDFLARE_API_TOKEN --env=prod --path=/cloudflare/deploy

Never run infisical secrets get in a transcript, issue, shell command that is recorded, or chat. Avoid infisical export unless there is a temporary, ignored destination and it is deleted immediately afterward.

Automation identity

If a CI or local automation needs access, create a read-only service token scoped solely to prod:/cloudflare/deploy, with a short expiry where possible:

infisical service-token create --name "air-con-for-the-vulnerable-deploy-read" --access-level read --scope "prod:/cloudflare/deploy" --expiry-seconds 2592000

Store the resulting service token only in the automation platform's encrypted secret store. It grants access to Infisical secrets, not Cloudflare directly.

Verification

Before committing or publishing, scan the workspace:

infisical scan .

If a secret appears in Git history, revoke/rotate it first, then remove it from history using an approved history-rewrite process.