Cloudflare.VulnerabilityScanner reference

VulnScannerCredential

Source: src/Cloudflare/VulnerabilityScanner/Credential.ts

A credential inside a Cloudflare Vulnerability Scanner credential set — an HTTP header or cookie value the DAST scanner attaches to outgoing requests so it can scan authenticated surfaces.

The credential value is write-only: Cloudflare never returns it, so the provider rotates it by comparing the desired value against the previously deployed one. name, location, and locationName are mutable in place; moving the credential to a different set triggers a replacement.

VulnScannerCredential: Creating a Credential

Authorization header

const creds = yield* Cloudflare.VulnerabilityScanner.VulnScannerCredentialSet("scanner-creds", {});

const apiKey = yield* Cloudflare.VulnerabilityScanner.VulnScannerCredential("api-key", {
  credentialSetId: creds.credentialSetId,
  location: "header",
  // Cloudflare requires normalized (lowercase) header/cookie names.
  locationName: "authorization",
  value: Redacted.make("Bearer my-api-key"),
});

Session cookie

const session = yield* Cloudflare.VulnerabilityScanner.VulnScannerCredential("session", {
  credentialSetId: creds.credentialSetId,
  location: "cookie",
  locationName: "session_id",
  value: Redacted.make("s3cr3t-session-token"),
});

VulnScannerCredential: Rotating the Value

// Change the redacted value and redeploy — the provider PUTs the new
// value even though the API never echoes it back.
const rotated = yield* Cloudflare.VulnerabilityScanner.VulnScannerCredential("api-key", {
  credentialSetId: creds.credentialSetId,
  location: "header",
  locationName: "authorization",
  value: Redacted.make("Bearer my-new-api-key"),
});

VulnScannerCredentialSet

Source: src/Cloudflare/VulnerabilityScanner/CredentialSet.ts

A Cloudflare Vulnerability Scanner credential set — a named container for authentication credentials (headers/cookies) the DAST scanner attaches to outgoing requests when scanning authenticated surfaces.

Add individual credentials to the set with Cloudflare.VulnerabilityScanner.VulnScannerCredential.

VulnScannerCredentialSet: Creating a Credential Set

Default name

const creds = yield* Cloudflare.VulnerabilityScanner.VulnScannerCredentialSet("scanner-creds", {});

Explicit name

const creds = yield* Cloudflare.VulnerabilityScanner.VulnScannerCredentialSet("scanner-creds", {
  name: "staging-credentials",
});

VulnScannerCredentialSet: Adding Credentials

const apiKey = yield* Cloudflare.VulnerabilityScanner.VulnScannerCredential("api-key", {
  credentialSetId: creds.credentialSetId,
  location: "header",
  locationName: "authorization", // Cloudflare requires lowercase names
  value: Redacted.make("Bearer ..."),
});

VulnScannerTargetEnvironment

Source: src/Cloudflare/VulnerabilityScanner/TargetEnvironment.ts

A Cloudflare Vulnerability Scanner target environment — declares which zone the DAST-style web vulnerability scanner (Security Center, beta) is allowed to scan.

The environment is identified by a server-assigned UUID. name and description are mutable in place; changing the target zoneId triggers a replacement because scan history is tied to the target.

VulnScannerTargetEnvironment: Creating a Target Environment

Scan a zone

const zone = yield* Cloudflare.Zone.Zone("site", { name: "example.com" });

const target = yield* Cloudflare.VulnerabilityScanner.VulnScannerTargetEnvironment("site-scans", {
  zoneId: zone.zoneId,
});

With an explicit name and description

const target = yield* Cloudflare.VulnerabilityScanner.VulnScannerTargetEnvironment("site-scans", {
  name: "production-site",
  zoneId: zone.zoneId,
  description: "Weekly DAST scan of the production zone",
});