Cloudflare is making it easier to put access controls around internal applications built on Workers.
The company says Cloudflare Access can now be attached directly to a Worker. Once applied, the policy follows that Worker across routes, custom domains, workers.dev addresses, and preview deployments. The goal is to remove the extra configuration steps that can leave small internal apps exposed.
Cloudflare frames the update partly around “vibe-coded” applications: quick tools built with AI assistance that may solve a real internal problem but skip the security polish of a traditional software project. Those apps can multiply quickly inside a company, especially when non-specialists are encouraged to build their own workflows.
The feature does not make generated code safe by itself. It addresses a narrower but important control: who can reach the application at all. As AI-assisted development lowers the cost of creating internal tools, automatic access enforcement becomes more important because security teams may not see every experiment before it is deployed.