Cloudflare.LeakedCredentialCheck reference

LeakedCredentialDetection

Source: src/Cloudflare/LeakedCredentialCheck/Detection.ts

A custom detection location for Cloudflare Leaked Credential Checks (/zones/{zone_id}/leaked-credential-checks/detections) — a pair of ruleset expressions telling the WAF where to find the username and password in your application’s login requests, so credentials submitted in non-standard payloads can still be checked against breach data.

Requires Leaked Credential Checks to be enabled on the zone (see LeakedCredentialCheck) — every detection operation fails with the typed LeakedCredentialChecksDisabled error otherwise. The number of custom detections is plan-gated (the free plan allows none — creation fails with the typed DetectionQuotaExceeded error).

Safety: detections carry no ownership markers. When there is no prior state, read scans the zone for an existing detection with the same expressions and reports it as Unowned, so the engine refuses to take it over unless --adopt (or adopt(true)) is set.

LeakedCredentialDetection: Custom detection locations

Detect credentials in a JSON login body

const check = yield* Cloudflare.LeakedCredentialCheck.LeakedCredentialCheck("Lcc", {
  zoneId: zone.zoneId,
});

yield* Cloudflare.LeakedCredentialCheck.LeakedCredentialDetection("LoginBody", {
  // Reference the check's zoneId so the toggle deploys first.
  zoneId: check.zoneId,
  username: 'lookup_json_string(http.request.body.raw, "user")',
  password: 'lookup_json_string(http.request.body.raw, "secret")',
});

Username-only detection

yield* Cloudflare.LeakedCredentialCheck.LeakedCredentialDetection("UsernameHeader",  {
  zoneId: check.zoneId,
  username: 'http.request.headers["x-username"][0]',
});

LeakedCredentialCheck

Source: src/Cloudflare/LeakedCredentialCheck/LeakedCredentialCheck.ts

The Leaked Credential Checks setting of a Cloudflare zone (/zones/{zone_id}/leaked-credential-checks).

Leaked credential detection scans incoming requests for authentication credentials previously seen in known breach compilations, populating the cf.waf.credential_check.* ruleset fields that WAF rules can act on (e.g. force a password reset on a leaked-credential login). The check is a zone singleton — it always exists (default enabled: false), so this resource never creates or deletes anything physical. Reconcile sets the flag when the observed value differs from the desired one; destroy restores the value the setting had before Alchemy first managed it (captured as initialEnabled).

Leaked-credential detection is available on all plans. Custom detection locations (see LeakedCredentialDetection) are plan-gated separately.

Only one LeakedCredentialCheck resource per zone makes sense — two instances managing the same zone would fight over the singleton.

LeakedCredentialCheck: Managing the check

Enable Leaked Credential Checks on a zone

const zone = yield* Cloudflare.Zone.Zone("Site", { name: "example.com" });

yield* Cloudflare.LeakedCredentialCheck.LeakedCredentialCheck("Lcc", {
  zoneId: zone.zoneId,
});

Explicitly pin the check off

yield* Cloudflare.LeakedCredentialCheck.LeakedCredentialCheck("Lcc", {
  zoneId: zone.zoneId,
  enabled: false,
});