Security & the Cloudflare token

The installer asks you to paste a credential for your own infrastructure into this website. That is an unusual thing to be asked, and this page is the whole answer rather than a reassuring half of it.

Why a token is needed at all

GhostPane is not a service you sign up to. It is a Worker, a database and a dashboard that run in your Cloudflare account, and that is the entire point of it — your visitors' data never reaches us because there is no "us" in the request path. The cost of that design is this page: something has to create those resources in your account, and Cloudflare's only mechanism for letting software do that is an API token.

If you would rather not hand a token to anyone at all, you do not have to. See doing it yourself below.

Exactly what the token can do

The install page gives you a link that opens Cloudflare's own token screen with these boxes already ticked. You review them there and press Create — we never see that screen, and nothing is pre-approved on your behalf.

Every install needs these three:

• Account · Workers Scripts · Edit
  Uploads the Worker and its Durable Objects. This is the software itself; without it there is nothing to install.
• Account · Workers KV Storage · Edit
  Creates the KV namespace the deployment uses for caching.
• Account · D1 · Edit
  Creates the D1 database your analytics are written to, and applies the schema.

And these four only if you want your dashboard on your own domain rather than a workers.dev address. Choosing the workers.dev address means you are never asked for them, because a deployment with no zone has nothing for them to reach:

• Zone · Zone · Edit
  Finds the zone your domain belongs to, and covers the zone-level writes below so a token cannot pass the checks and then fail halfway.
• Zone · Workers Routes · Edit
  Attaches your dashboard's hostname, and — only if you asked for edge mode — puts the Worker in front of the site you chose.
• Zone · DNS · Edit
  Creates the DNS record that points your chosen hostname at the deployment.
• Zone · Zone WAF · Edit
  Adds rate-limiting rules that protect your login and collector from floods. The only one nothing breaks without — the install finishes and tells you it skipped this.

What the token can also do, which we would rather it could not

This is the part usually left out. Cloudflare's permissions are per capability, not per resource, unless you narrow them yourself. A token with "Workers Scripts · Edit" can edit any Worker in that account, not only the one being installed — and the same is true of the KV and D1 permissions. There is no version of this ask that is precisely scoped to the resources the install creates, because those resources do not exist yet at the moment you create the token.

Three ways to make that not matter, in the order we would suggest them:

• Delete the token when the install finishes. It has no further use — your deployment does not hold it and never asks for it again. The last screen of the wizard says this, and this is why.
• Narrow it on Cloudflare's screen. The template arrives asking for all accounts and all zones because it cannot know which you will pick. You can restrict it to one account and one zone before pressing Create, and the wizard's preflight will tell you plainly, by name, if you narrowed it too far.
• Or use a separate Cloudflare account. GhostPane is designed to share an account cleanly — every binding it creates is GP_-prefixed for exactly that reason — but if the account also runs something you would not want touched, a fresh account removes the question instead of answering it.

Where the token goes

Into the memory of the request that uses it, and nowhere else. It is never written to the database, to the cache, to Durable Object storage, or to a log line — including inside an error message, which is the usual way a credential ends up somewhere it was not meant to be.

There is a visible consequence, and it is the best evidence that the sentence above is true: an interrupted install cannot be resumed. If you close the tab, the run stops, because the only copy of the token went with the request. Recovery is to paste it again — every step is idempotent, so a second run continues from where the first stopped rather than duplicating anything. A resumable install would be a nicer product and would require storing the token, and that trade was refused.

What your deployment does after we walk away

Nothing reports back to us. There is no licence check at runtime, no usage counter, no heartbeat — the software has no idea we exist. One exception is deliberate and worth knowing precisely: a Check for updates button in your dashboard asks this storefront which build is current. It runs only when you press it, it is made by your Worker rather than your browser, and it carries no identifier of you or your installation.

The practical version of that: if we stopped answering email tomorrow, your installation would keep working indefinitely. The Worker, the database and every row in it are in your Cloudflare account, under your billing, exportable as CSV or queryable with SQL. There is no service to be shut off and no key that expires. That is the same property that makes the privacy claim true, and it is the honest answer to "what if you disappear" — a question every one-time purchase from a small vendor deserves to have answered.

What we keep about you

Your email address, which tier you bought, a masked form of your licence key, and a log of how the install went — so that "did my domain ever connect properly" is answerable months later, which is not a question your own deployment can be asked. Never your token, never your dashboard password, never your full licence key, never your IP address, and nothing whatsoever from inside your installation once it is running. The privacy page lists this in full, including how long each part is kept.

Doing it yourself, with no token given to anyone

The hosted wizard is a convenience, not the product. The same twelve steps run from a command line against a token that never leaves your machine — it is the same code in both paths, so nothing about the result differs. If you are comfortable in a terminal, that is the version to use, and buying a licence is not a prerequisite for reading how it works first.

The free tier is also a real answer here: it installs by the same route, costs nothing, does not expire, and upgrading later re-runs the installer against the same Worker and the same database with no migration and no data loss. Trying it on a site that does not matter to you is a cheaper way to decide than reading this page twice.

How the deployment protects itself

• Passwords are stored as PBKDF2 hashes with a per-user salt, never in a recoverable form. Failed logins are throttled per address at the edge.
• Sessions are signed with a secret generated during your install and written once — a re-run never regenerates it, because that would sign every user out.
• The public pages are served under a strict Content Security Policy with a nonce and no inline script, plus HSTS and the usual hardening headers. You are welcome to check the response headers on this page.
• Rate-limiting rules in front of the login and the collector are applied during the install where the token permits it, and the install tells you if it could not.
• The Stats API uses per-site bearer tokens you create and revoke yourself, scoped to one site and read-only.

Reporting a security problem

Email support@ghostpane.com with what you found and how to reproduce it. There is no bounty programme and it would be dishonest to imply one — what there is instead is a direct line to the person who wrote the code, an acknowledgement, and credit if you want it. Please do not test against another customer's installation; ask and a target will be provided.