CF-Incidents Data Loss Prevention - Detect Cloudflare API tokens with DLP

[ENF News Bot]

The Credentials and Secrets DLP profile now includes three new predefined entries for detecting Cloudflare API credentials:

Entry name	Token prefix	Detects
Cloudflare User API Key	cfk_	User-scoped API keys
Cloudflare User API Token	cfut_	User-scoped API tokens
Cloudflare Account Owned API Token	cfat_	Account-scoped API tokens

These detections target the new Cloudflare API credential format, which uses a structured prefix and a CRC32 checksum suffix. The identifiable prefix makes it possible to detect leaked credentials with high confidence and low false positive rates — no surrounding context such as Authorization: Bearer headers is required.

Credentials generated before this format change will not be matched by these entries.

How to enable Cloudflare API token detections​

https://developers.cloudflare.com/changelog/rss/#how-to-enable-cloudflare-api-token-detections

1. In the Cloudflare dashboard ↗︎, go to Zero Trust > DLP > DLP Profiles.
2. Select the Credentials and Secrets profile.
3. Turn on one or more of the new Cloudflare API token entries.
4. Use the profile in a Gateway HTTP policy to log or block traffic containing these credentials.

Example policy:

Selector	Operator	Value	Action
DLP Profile	in	Credentials and Secrets	Block

You can also enable individual entries to scope detection to specific credential types — for example, enabling Account Owned API Token detection without enabling User API Key detection.

For more information, refer to predefined DLP profiles.

Continue reading...