High-risk tools in Cloudflare
4 of the 92 tools in Cloudflare are classified as high risk. This page profiles those tools specifically, with recommended policy actions and the attack patterns that target them.
Every operation listed below is an action PolicyLayer recommends controlling at the transport layer. Open any tool to see the full profile, risk score, and YAML policy snippet.
Tools at high risk
-
container_execExecuteRun a command in a container and return the results from stdout. If necessary, set a timeout. To debug, stream back standard error. If you
-
container_initializeExecuteStart or restart the container. Use this tool to initialize a container before running any python or node.js code that the user requests ro run.
-
dex_create_remote_pcapExecuteCreate a remote packet capture (PCAP) for a device. This is a resource intensive and privacy-sensitive operation on a real user device.
-
dex_create_remote_warp_diagExecuteCreate a remote Warp Diagnostic (WARP-diag) for a device. This is a resource intensive and privacy-sensitive operation on a real user device.
Attacks that target this class
High-risk tools in any server share these documented attack patterns. Each links to the full case and the defensive policy.