Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

`workers secrets update` without `--text` exits 0 and deploys a version with no secret value; piped stdin is ignored

Open Beginner friendly
  • Is something wrong?
#344 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
78/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
node.js, typescript
Domain
cli, security

Research direction

Start with the implementation and tests for the cf workers secrets update command, then run the provided --dry-run reproduction to confirm that the request body lacks the value. Verify both piped stdin and an omitted value are handled according to the expected behavior. Done means no API request or Worker deployment occurs when the value is missing, the command exits non-zero with a clear message, and regression tests cover the case.

Written by the indexing model from the issue text.

Description

Summary of the issue

cf workers secrets update <name> doesn't require a value. If you leave out --text (or --key-base64/--body), it sends a request with no value, exits 0, and the API creates and deploys a new Worker version. Piped stdin is silently ignored, so this obvious way of keeping a secret out of shell history looks like it worked but didn't set the value:

echo "my-secret" | cf workers secrets update API_KEY --worker my-worker --type secret_text
# exit 0, prints {"name":"API_KEY","type":"secret_text"}; a new version is deployed

--dry-run shows the request has no value at all:

$ echo "piped-secret" | cf workers secrets update API_KEY --worker some-worker --type secret_text --dry-run
{
  "command": "cf workers secrets update",
  "method": "PUT",
  "url": "https://api.cloudflare.com/client/v4/accounts/<account-id>/workers/scripts/some-worker/secrets",
  "bodyKind": "json",
  "body": { "type": "secret_text", "name": "API_KEY" }
}

On a throwaway Worker, this call returned success and produced a new deployed version, just like a call with --text.

Expected behaviour

When --type secret_text has no value, the command should fail before sending anything (or use the hidden prompt / stdin input asked for in #150). Piped stdin should never be silently dropped. If it isn't read, the command should say so and exit non-zero.

Version of cf used

1.0.0-beta.16 (in the beta.18 source, --text is still optional with no check)

System information and package versions
cf 1.0.0-beta.16 (also checked in the beta.18 package source)
macOS 27.0 arm64, Node 26.8.2, npm 11.19.1
Reproduction (optional)
echo "value" | cf workers secrets update API_KEY --worker <worker> --type secret_text --dry-run   # body has no "text"
echo "value" | cf workers secrets update API_KEY --worker <worker> --type secret_text             # exit 0, new version deployed
Relevant error logs (optional)

None. That's the problem. Related: #150 (stdin/prompt input, a feature request), #102 (secrets update accepts invalid names).

Dominant language
TypeScript
Stars
853
Forks
42
Avg merge
16h 43m
Merged PRs (30d)
160

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from cloudflare/cf

All issues in cloudflare/cf

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.