The Cloudflare Appstore (Appflare) Malware Audit

An agent-assisted review of Appflare’s app catalog traced a password-reset token leak and private note data sent to upstream services. The process, evidence, and limits. A link shortener’s password-reset page should be a fairly boring place. You open the link, choose a password, and get back to work. In one app we reviewed, opening that page also handed the reset token to an upstream analytics service. That was the most serious result of an agent-assisted audit of Appflare, an app store for your own Cloudflare account. I asked Codex to look through the catalog for code that had no business running in an app someone would install. The brief was deliberately narrow: credential theft, hidden data collection, backdoors, unrelated account changes. A list of routine hardening suggestions wouldn’t answer it.