Anyone who has shipped a quick internal tool knows where it leaks. Not through the main address. Through the preview URL you gave one colleague and forgot.
Fact
The facts: on 14 August 2026 Cloudflare announced that Access policies can attach directly to a Workers application rather than to a hostname. The check happens before the request reaches your code. Coverage includes custom domains, routes, the service address and preview URLs, and can be narrowed to previews only. It can be enabled account wide, so it applies by default to all applications. In code the signed-in identity is read through ctx.access.getIdentity(), and locally it is tested with a simulated user.
The difference is in the order of things. Until now you ship the app and then remember to fence it. Now it is born fenced and you decide what to open.
Security that needs you to remember it has already arrived late.
We keep a client area and internal panels behind exactly this kind of door. If you have a tool running on a quick fix, this is half an hour of work today.
Official primary sources
Cloudflare Blog - Secure all your internal vibe-coded applications in one clickThe visual is generated code-art, no third-party images.