COPY. CONFIGURE. VERIFY.

Your signal. Your infrastructure.

Give your agent a deployment brief for your own Cloudflare account.

Open your agent in the intended codebase and confirm it can access that checkout.
Copy this brief. Let the agent inspect your installed version and propose the required configuration.
Supply credentials through your secret manager. Verify with a harmless connection test before enabling investigation jobs.

Deploy to Cloudflare → or use the agent prompt below. Follow the setup guide on GitHub to configure your account, secrets, app URL, and build command.

Setup prompt

Deploy my own instance of Rails CVE from https://github.com/aviflombaum/rails-cve into MY Cloudflare account. Clone that repository (or use my existing checkout) and follow https://github.com/aviflombaum/rails-cve/blob/main/docs/deploy-with-agent.md. Read AGENTS.md, README.md, docs/self-hosting.md, docs/deploy-with-agent.md, docs/egress.md and docs/integrations/email.md first. Inspect the checkout and installed tools. Use the existing authenticated Cloudflare session when available; never reuse the original author's credentials or database.

Ask only for missing account/domain choices or external credentials. Do not print secrets or put them in command arguments, tracked files, commits or deployment logs. Use a protected secret store, interactive Wrangler secret input, or an ignored mode-0600 secrets file. Generate independent random 32-byte ENCRYPTION_KEY and ADMIN_TOKEN values; preserve existing keys on upgrades.

Install with bun install --frozen-lockfile. Run the local setup and migrations, bun run check, and a Wrangler dry-run. Create a dedicated D1 database in my selected account. Create or update ignored wrangler.deploy.jsonc, retaining bindings/assets/cron/rate limiter/node compatibility and migration paths. Set the database ID and a unique Worker name. APP_URL must be the exact final HTTPS origin with no trailing slash. Use workers.dev unless I selected an owned custom hostname. Never overwrite an existing deployment file blindly.

Apply numbered remote migrations with the deployment config (back up an existing D1 first), upload required secrets, and deploy using bun run deploy. The baseline sync must be quiet. Wait for cron or call the admin sync using a token loaded privately from secret storage. Verify /api/health, advisory pages, social image and account creation. Document the first-sync 503 while initializing.

Email and GitHub login are optional. Webhooks require the bundled Node egress gateway: read docs/egress.md, prepare an isolated host and TLS reverse proxy, and configure EGRESS_PROXY_URL plus an independent secret EGRESS_PROXY_TOKEN. Obtain approval before provisioning or deploying it. Without that configuration, report webhook delivery as disabled; do not bypass the gateway or claim the Cloudflare button provisions it. For SMTP use implicit TLS port 465, my verified sender domain, EMAIL_TRANSPORT=smtp, EMAIL_FROM, SMTP_HOST and secret SMTP_USERNAME/SMTP_PASSWORD. Use only a sender authorized for my own deployment. Cloudflare Email Service is an alternative if I onboard a sending domain and add an EMAIL binding. Confirm outbound email with a recipient I authorize, not arbitrary subscribers.

For GitHub login, guide me through creating my own GitHub App with callback <APP_URL>/auth/github/callback, then configure GITHUB_CLIENT_ID and secret GITHUB_CLIENT_SECRET. Do not request repo scopes or enable a repository issue bot that this release does not implement. Keep optional integration states visibly disabled until configured.

Use a receiver I control to verify the signed challenge and send a test; ensure event history records the result without exposing credentials. Do not trigger real advisory investigations or production changes as a smoke test. Finish with my URL, deployed version, database/migration status, secret NAMES only, checks performed, remaining optional setup, estimated resource usage caveats and rollback/backup instructions. Leave the checkout free of tracked credentials.

Research checked September 22, 2026. Installed versions may differ. Official reference ↗