| name | infisical |
| description | Manage the Air Con for the Vulnerable Website deployment secrets through its dedicated Infisical project without exposing or broadening credentials. |
Infisical: Air Con for the Vulnerable Website
Scope
This repository is linked in .infisical.json to the dedicated Air Con for
the Vulnerable Website secret-manager project in Infisical EU Cloud. Its
project ID is 4cf95ea0-9eec-4d46-af1e-fc07f5c0d239. Do not switch the
repository back to a shared/general-purpose project.
The Cloudflare deployment credentials belong only in:
environment: prod
path: /cloudflare/deploy
secret names: CLOUDFLARE_OAUTH_TOKEN, CLOUDFLARE_OAUTH_REFRESH_TOKEN,
CLOUDFLARE_OAUTH_EXPIRATION_TIME, CLOUDFLARE_OAUTH_SCOPES
This project currently uses a renewable Wrangler OAuth credential because a
user API token with the required site-only scope is unavailable. It is
account-wide and must remain only in Infisical; it is never committed or
exported to a local .env file. Replace it with a least-privilege API token
after moving the Worker and zones to a dedicated Cloudflare account.
Prerequisites
Install the Infisical CLI, then authenticate against EU Cloud:
infisical login --domain https://eu.infisical.com
.infisical.json is safe to commit. Credential files and exported secrets are
not.
Normal use
Run a process with scoped production deployment secrets injected only into that
process:
infisical run --env=prod --path=/cloudflare/deploy -- npm run deploy:cloudflare
The repository shorthand is npm run deploy.
To rotate the OAuth credential, first run npx wrangler login, then use a
secure, non-logged automation to update the four credential values in the
configured Infisical path. Do not print, export, or paste their values into
chat, source, or shell history.
infisical secrets set CLOUDFLARE_API_TOKEN --env=prod --path=/cloudflare/deploy
Never run infisical secrets get in a transcript, issue, shell command that is
recorded, or chat. Avoid infisical export unless there is a temporary,
ignored destination and it is deleted immediately afterward.
Automation identity
If a CI or local automation needs access, create a read-only service token
scoped solely to prod:/cloudflare/deploy, with a short expiry where possible:
infisical service-token create --name "air-con-for-the-vulnerable-deploy-read" --access-level read --scope "prod:/cloudflare/deploy" --expiry-seconds 2592000
Store the resulting service token only in the automation platform's encrypted
secret store. It grants access to Infisical secrets, not Cloudflare directly.
Verification
Before committing or publishing, scan the workspace:
infisical scan .
If a secret appears in Git history, revoke/rotate it first, then remove it from
history using an approved history-rewrite process.
