What problem does it solve? Edge security misconfigurations leave applications exposed: publicly reachable origins bypass the WAF entirely, overly aggressive rules break legitimate traffic, and missing rate limits invite credential stuffing and scraping. This Skill provides a structured audit of Cloudflare edge protection so gaps are found before attackers find them. ## Core Features & Use Cases - Exposure Audit: Verify the origin IP is hidden behind Cloudflare IP allowlists or Tunnel, TLS is Full (strict), and subdomains are correctly proxied. - WAF Rule Review: Check managed rulesets (Cloudflare Managed + OWASP Core), custom rule expressions, rule ordering, and false-positive risks. - Rate Limiting & Bot Posture: Define per-endpoint rate limits for login, OTP, and expensive APIs, and configure bot management without blocking verified bots like Googlebot. - Use Case: Before launching a SaaS app on Cloudflare, run this review to confirm the origin is not directly reachable, login endpoints have per-IP and per-account limits, and webhook allow rules precede challenge rules. ## Quick Start Review my Cloudflare zone configuration for example.com and produce an edge security report covering origin exposure, WAF rules, and rate-limit coverage.
