Cloudflare Reports 79% Fewer Secrets in Code After Security Rule Changes

Cloudflare says changes to its code scanning and development workflows reduced secrets found in code by 79% and potential SQL injection and code injection vulnerabilities by 44%. The results, reported for work in the second half of 2024, show how targeted checks can move security fixes earlier in software development, where teams can address findings before code reaches production.

The company’s approach centers on preventing recurring vulnerability types at their source. Its Product Security team expanded automated scanning rules, tuned them against patterns in Cloudflare repositories, and made high confidence findings block a build. That gives engineers a direct signal during code review, while reducing reliance on fixes made after deployment.

Prevention begins in the development workflow

Cloudflare describes the work as part of its effort to reduce entire classes of vulnerabilities. It signed the Secure-by-Design pledge on May 8, 2024, and says the effort aligns with a wider commitment to make security a standard part of product and platform development. The company previously explained that commitment in a post about its pledge.

The team focused on two categories: injection flaws and secrets embedded in source code. Injection can occur when software fails to keep data separate from executable instructions, often because input validation or sanitization is insufficient or developers use unsafe functions. Depending on the affected system, a successful injection can compromise confidentiality, integrity, or availability.

Secrets in source code create a different exposure. Credentials or other sensitive information committed to a repository can be disclosed and may enable unauthorized access. Cloudflare says it reviewed repository patterns and tool performance in 2023, then wrote additional detection rules to lower the chance that secrets would be added to new code.

The company’s stated aim is to prevent both categories regardless of severity. Its argument is practical: secure frameworks and defaults can reduce the number of risky coding choices developers need to make, while handling sensitive values through dedicated storage systems keeps them out of source files. Addressing the underlying patterns can also reduce the need to repeat the same kind of remediation across products.

Rules are tuned before they block changes

Cloudflare integrated new and customized rules into its static application security testing (SAST) tools, which run in CI/CD workflows. The scans look for insecure code, exposed secrets, and software supply chain issues. The team also strengthened the criteria used to approve code for production.

New rules first ran in monitoring mode. This gave the security team a chance to observe what they flagged, identify false positives, and adjust priorities before enforcement. Cloudflare says it used internal threat models and repository trends to tailor rules to its infrastructure. After tuning for precision, the team enabled blocking mode for selected findings.

In that mode, each pull request (PR) and merge request (MR) is scanned against the relevant rules. When a targeted issue is detected, the build can fail, stopping the change before it is merged or released. Cloudflare says its injection checks were put into blocking mode across severity levels.

That enforcement depends on the quality of the rules. A scanner that frequently flags harmless code can slow development and encourage teams to ignore alerts. Cloudflare’s sequence—observe, tune, then block—aims to make the checks useful enough to enforce without creating unnecessary friction. Its account underscores that automation works best when teams can explain what a rule catches and respond to its findings.

Training and secure defaults support automation

Scanning is only one part of the program. Cloudflare says it has increased the use of frameworks that separate data from code, and relies more on secure storage and secrets management tools within the development pipeline. These defaults make it easier to avoid common mistakes without depending on every developer to remember a separate manual step.

The company also expanded guidance and training for engineering teams, including advice on preventing vulnerabilities and using its centralized secrets platform through automated processes. This matters because tools can detect known patterns, but developers still need to understand how their choices affect the security of a system. The stated goal is to make secure practices part of routine work.

Cloudflare describes security reviews, code scanning, and vulnerability testing as ongoing parts of its effort to find injection risks. It says improvements to detection precision have helped the team identify issues earlier and block them at the source. The combination of review, automated checks, secure defaults, and developer guidance is intended to reduce the likelihood that the same weakness enters multiple code paths.

Reported results and remaining work

In the second half of 2024, Cloudflare added rules that found and removed newly introduced secrets from code repositories. The company reports that secrets in code fell by 79% compared with the previous quarter. It also says new blocking rules contributed to a further 44% reduction in potential SQL injection and code injection vulnerabilities.

Those figures describe changes in Cloudflare’s own repositories and detection program; the source does not provide the underlying counts or a detailed measurement method. The reported reductions therefore show the company’s stated outcome, while leaving readers without enough information to independently compare the absolute scale of findings or reproduce the calculation.

Cloudflare acknowledges that security tools can produce false positives. Its emphasis on high confidence rules reflects a central operational constraint: blocking checks can prevent risky changes, but only if the findings are precise enough for engineers to act on. Monitoring and tuning provide a way to calibrate that balance before enforcement.

The company plans to keep developing secure frameworks, threat modeling across its systems, automated security checks throughout the software development lifecycle, and role based training on security practices. It also described a goal of meeting all seven commitments in the Secure-by-Design pledge by May 2025, and pointed to a separate update on its work on Goal #5.

For software teams, the useful takeaway is the process: inspect patterns in existing repositories, start new rules in monitoring mode, refine them against real findings, and then block changes when the checks are reliable. Cloudflare’s results make a case for measuring whether those controls reduce recurring vulnerability types, alongside tracking the alerts they generate.

Further updates are available on Cloudflare’s blog. The company says product security remains part of its development process and that it will continue building on these prevention measures.