[MendyLanda]

Enrol projects/appflare

I have verified each of the following before submitting this project (tick each box by changing [ ] to [x]):

• I am a core maintainer of this project.
• I accept the OSS Scanner terms.
• I confirm that I believe my project meets the inclusion criteria and is an established project that users depend on.
• project.yaml follows the README (one project per PR; tools/validate.py passes locally).
• tools/check <name> builds the project, and its tests run in the shell that follows.
• primary_contact must be the email address of the primary security contact.
• There is a Dockerfile that builds the project (required) in one of two places: in the project's repository at the path dockerfile: names, or next to project.yaml in this repo.
• threat_model.md is written for this project (recommended but optional), placed in the same way: in the repository at the path threat_model: names, or next to project.yaml in this repo.

To sign the CLA, post a comment on this pull request that contains only this line: I have read the CLA Document and I hereby sign the CLA

To change an enrolment, edit project.yaml; to pause reports, set disabled: true; to withdraw the project, remove projects/<name>/.

Context: Appflare is an app store that runs in the user's own Cloudflare account. Its manager Worker holds a Cloudflare credential that can change Workers, D1, KV, R2, DNS and Access across the whole account. It installs third-party apps from a public catalog, and can build them from source in a container in that account. The hosted installer on appflare.dev handles visitors' Cloudflare OAuth access tokens. A flaw in signature verification, auth, roles, or the sandbox's credential isolation gives an attacker the user's Cloudflare account. The project is young (first commit September 2026) but has users installing it into production accounts; the catalog lists 100+ apps.

On building: I built the Dockerfile with podman from a fresh clone (Docker isn't available on my machine, so I didn't run tools/check itself). pnpm install, pnpm build and every package's tests pass. The manager's suite (434 files, 5,104 tests) also passes in that image with --network=none. The Dockerfile's smoke test skips the manager because its suite is the slowest; the threat model says how to run it.

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[github-actions]

Enrolment triage: projects/appflare

Repository: appflare/appflare at main · opened by MendyLanda

	Check	Result
⚠️	Repository	under 6 months old (created 27 days ago, last push yesterday)
⚠️	Stars / forks	no watchers: little sign that others use it (238 stars · 14 forks · 0 watching)
⚠️	Outside participants	none: the last 50 issues and pull requests were all opened by the project's own people or by bots
ℹ️	Criticality score	0.26 on the OpenSSF scale of 0 to 1 signals created_since 0, updated_since 0, contributor_count 2, org_count 0, commit_frequency 6.0, recent_releases_count 18, closed_issues_count 96, updated_issues_count 96, comment_frequency 1.1, dependents_count 17
ℹ️	Package rank	by downloads: nothing from this repository found in the top 10,000 on npm
✅	License	Apache-2.0
✅	Opened by an active maintainer	member of the owning organisation; 100+ commits in the last 12 months; #1 contributor
ℹ️	Contact in SECURITY.md	no SECURITY.md to check landamendy@gmail.com against
ℹ️	OSS-Fuzz	not found in OSS-Fuzz
ℹ️	.oss-scanner/ in the repository	not present; the Dockerfile is in this pull request
✅	Pull request scope	only this project's directory
✅	tools/validate.py	passes
✅	Checklist	all 8 ticked

_{Automated, from public data, to help reviewers. Enrolment is decided case by case against the criteria. If you think we got something wrong, please tell us in a reply.}

[MendyLanda]

I have read the CLA Document and I hereby sign the CLA

[oss-scanner]

Could you please comment on how widely this project is used? Our enrollment criteria states:

We accept established projects that have a critical impact on infrastructure and user security. We will consider each request on a case-by-case basis, but some things we keep in mind are: (1) Exposure to remote attacks (e.g. libraries that are used to process untrusted input); and (2) Number of users/other projects depending on this project.

I'm closing this PR for now, if you feel it should be included under these criteria then please re-open.