FLARECHECK

PUBLIC BUILD / 002

Cloudflare Workers / preflight inspection

Catch the config bug before prod does.

FlareCheck scans wrangler.jsonc for environment drift, committed secrets, blind deploys, and missing production evidence.

Use the GitHub Action
  • 00accounts
  • 00uploads
  • 09rules
FC / DIAGNOSTIC READY
READINESS 92/100

SCAN COMPLETE

ERROR
00
WARNING
01
PASSED
08
  1. 01
    ConfigLoaded
  2. 02
    BindingsMapped
  3. 03
    SecretsChecked
  4. 04
    Deploy pathVerified
01

Why another check?

A green build only proves the code can build.

Wrangler configuration decides which databases, routes, secrets, runtime behavior, and logs your Worker gets after deployment. FlareCheck checks that layer before a typo becomes an incident.

FLARECHECK / v0.9.0 wrangler.jsonc 
$ flarecheck

PRODUCTION READINESS     72/100

✕ ERROR   FC003
Likely secret committed as API_KEY
→ wrangler secret put API_KEY

! WARNING FC005
staging is missing d1_databases
→ declare it in env.staging

1 error · 2 warnings · 6 passed

EXIT 02 / ACTION REQUIRED

02

Cloudflare Workers checks

Nine opinions.
All inspectable.

Every FlareCheck finding has a stable rule ID, an explanation, a suggested fix, and a link to the relevant Cloudflare documentation. Read the full rule reference →

  1. FC001

    Compatibility date

    Find a missing, invalid, or stale compatibility date.

    RUNTIME
  2. FC002

    Node.js compatibility

    Flag projects that may fail when a dependency expects Node built-ins.

    RUNTIME
  3. FC003

    Committed secrets

    Detect likely credentials stored in plain-text Wrangler vars.

    SECURITY
  4. FC004

    Production observability

    Check that Workers Logs and intentional sampling are configured.

    EVIDENCE
  5. FC005

    Environment drift

    Find bindings omitted from environments because they are not inherited.

    CONFIG
  6. FC006

    Explicit deploy target

    Catch deployment scripts that can accidentally target the root Worker.

    RELEASE
  7. FC007

    Modern config format

    Recommend JSONC when a project still uses Wrangler TOML.

    MAINTENANCE
  8. FC008

    Shared environment resources

    Warn when staging points at the same stateful resource as production.

    ISOLATION
  9. FC009

    Explicit environment routes

    Catch routed Workers whose named environments have no declared target.

    ROUTING
03

How FlareCheck works

One command.
A useful answer.

Run FlareCheck from a Cloudflare Workers project or pass a path. It discovers Wrangler JSON, JSONC, or TOML and reads package scripts without executing project code. Add --all to inspect every Worker in a monorepo.

  1. 01

    Discover

    Locate the Worker config and project root.

  2. 02

    Inspect

    Run deterministic checks against configuration and scripts.

  3. 03

    Act

    Return plain-language fixes, documentation, and CI-safe exit codes.

Human-readable by default

flarecheck

Structured for automation

flarecheck --json

Warnings fail CI

flarecheck --strict

Exact file + line annotations

flarecheck --github --strict

Discover every stable rule ID

flarecheck --list-rules

Adopt a focused rule set

flarecheck --only FC003,FC005

Scan every Worker in a monorepo

flarecheck . --all

Feed GitHub Code Scanning

flarecheck --sarif > flarecheck.sarif

Use the reusable GitHub Action

loke-dev/flarecheck@v0.9.0
04

Common questions

Before you run it.

What does FlareCheck inspect?

It reads Wrangler configuration and package scripts to find high-confidence deployment risks. It never executes your Worker.

Does FlareCheck upload my source code?

No. The entire scan runs locally. There is no account, telemetry service, or source upload.

Can I run it in CI?

Yes. Use --github for file annotations, --json for structured output, and --strict to fail on warnings.

Can I select which rules run?

Yes. List stable IDs with --list-rules, run a focused subset with --only, or skip specific checks with --ignore.

Can it scan a Workers monorepo?

Yes. Run flarecheck . --all to discover every Wrangler configuration recursively and get per-Worker results plus an aggregate summary.

Does it support SARIF and Code Scanning?

Yes. --sarif produces a SARIF 2.1.0 report with rule metadata, severities, file locations, suggested fixes, and stable fingerprints.

Is there a reusable GitHub Action?

Yes. Install it from GitHub Marketplace or add loke-dev/flarecheck@v0.9.0 directly for exact file and line annotations, strict warnings, monorepo scanning, and rule selection.

Does it replace Wrangler validation?

No. Wrangler validates configuration shape. FlareCheck adds production-readiness opinions about valid configurations that can still be risky.

Preflight status / awaiting config

Make production
less surprising.