Security Shield

System Health: Auditing...

Cloudflare isolates sandboxing and D1 database cluster health monitoring.

D1 Ping

...

Workers AI

...

Live Cloudflare Isolate Diagnostics

D1 Database Binding

restaurants

Checking

custom_dishes

Checking

polls

Checking

poll_votes

Checking

lunch_history

Checking

Workers AI (Taste Buddy)
Google Places API Credentials
Immutable D1 Backups

Daily gzipped database snapshots are uploaded to R2 (the-one-dish-backups) with a 30-day WORM retention policy.

Content Security Policy (CSP) Monitor

ENFORCING

Cryptographic nonces are dynamically injected into script tags at the edge. Browsers report violations to /api/csp-report.

Latest GitHub Workflow Runs

Private Repository Actions Status

This repository is private. To view the real-time status of Snyk, Semgrep, Socket, and Playwright E2E runs, paste a read-only Personal Access Token (PAT). It is stored strictly locally in your browser.

Active Protections

  • Dynamic Edge-Side CSP NoncesCloudflare edge rewrites HTML script tags dynamically at request time to block unauthorized scripts.
  • Immutable Backups (WORM)Daily database snapshots are gzipped and locked against deletion for 30 days in R2.
  • GitHub Secret ScanningPrevents API tokens and keys from entering git history.
  • Isolate Container SandboxGuarantees zero cold starts and total runtime CPU isolation on Cloudflare.
  • Auto-Patch IntegrationDependabot generates security fixes, and CI merges minor/patch fixes instantly.

Audit Trail

JULY 11, 2026Configured Edge-Side CSP Noncing

Implemented Cloudflare edge-side script noncing middleware and live D1 database reporting endpoints.

JULY 10, 2026Implemented Immutable Backups

Configured scheduled backup worker and 30-day WORM R2 bucket lock policies.

JULY 9, 2026Implemented Diagnostics Dashboard

Launched serverless diagnostic agent at `/api/self-test`.

JULY 9, 2026Resolved Silent Write Failures

Added client rollback triggers for dish additions and upvoting.

JULY 9, 2026Created Playwright E2E verification

Configured local D1 database seeding and E2E build verification.

JULY 9, 2026Enabled Snyk & Semgrep Scanners

SAST vulnerabilities and dependency compliance scans integrated in CI.