Driftwatch

Cloudflare / Cloudflare API /

Breakingdirection flip: their tools call this safe

repo_hosts is no longer accepted

What changed

Usually ignored rather than rejected, so the call succeeds and does something subtly different.

Affects repo_hosts on managed-defense-vulnerability-discovery_CreateScan reachable from 1 operation. Grep for it: nothing else will tell you.

Who is affected

Code that sends Cloudflare's managed-defense-vulnerability-discovery_CreateScan objects, used by 1 Cloudflare operation.

Before and after

WhereBeforeAfter
managed-defense-vulnerability-discovery_CreateScan.repo_hostspresentabsent

Code that breaks

await client.post("/…", {
  // repo_hosts is now ignored, not rejected
  repo_hosts: value,
});

Based on Cloudflare’s published API specification. How severity is decided.