Prioritizing Vulnerabilities With Production Context
A vulnerability scanner reporting thousands of findings — dozens of them critical — raises an immediate question: which one gets fixed first? Cloudflare's answer is a new early-access service called Vulnerability Discovery and Remediation (VDR), part of Cloudflare Managed Defense. The invitation-only offering detects and mitigates vulnerabilities in customer codebases using OpenAI Daybreak models, including GPT-5.6 Cyber, accessed through the OpenAI Daybreak Defense Network.
The service works against codebases customers authorize for inspection. It performs reconnaissance, hunting, and validation, then proposes solutions with automatically checked patches and mitigations before anything reaches human review. Crucially, customers retain control: Cloudflare may suggest code patches and WAF rules, but deployment decisions remain with the customer.
Why Context Changes the Priority Order
The volume of findings is growing as LLMs scan entire codebases in minutes, but volume was never the core challenge. Speed is. Attackers using AI can accelerate discovery and exploitation, shrinking the window security teams have to decide what matters. Traditional scans compound this by omitting production context — a handler flagged as vulnerable may not be deployed, may sit behind an unused route, or may already have protections in place.
Cloudflare's global network supplies that missing context. VDR can see which routes are active, their traffic volume, and surrounding security events. When customers enable VDR with the Web Application Firewall (WAF), it can also see which rules are already applied and blocking attacks. That transforms a generic finding into a specific priority: code that is live, on a heavily trafficked route, with recent attack activity and no existing protection. From there, VDR can propose custom WAF mitigations and tailored code patches.
The service builds directly on the model-agnostic vulnerability harness Cloudflare described in Build your own vulnerability harness, which scans Cloudflare's own fleet, adversarially validates every finding, and turns raw model output into fixes engineers can trust. VDR extends that pipeline to customer-authorized code and connects findings to production traffic, security events, and edge controls.
Correlating Source Findings With Traffic and Security Signals
VDR operates across Cloudflare Workers and proxied applications. The process starts with a snapshot of traffic and security data from Web Assets and WAF, showing which routes are active, how much traffic they carry, and whether recent security events are associated with each one. A path with a high volume of detection triggers may be flagged as more security-critical. Web Assets and WAF form the first and second pillars of the service respectively.
Source code vulnerability analysis then identifies potential weaknesses, but that analysis alone does not show which routes reach the code, how much traffic those routes handle, whether they receive suspicious requests, or which protections apply. VDR treats high-request-volume routes as "hot paths" and subjects source deployed to them to stricter security profiling. These combined signals provide evidence of how an API is used and where a vulnerability may be exposed.
For Workers specifically, VDR pulls the most recent source and its configured routes, then correlates those routes with Web Assets and request metadata from Workers Observability to tie the exact source to the endpoints it serves in production. The network context persists through the investigation, available to agents when needed.
Reconnaissance, Hunting, and Validation
The harness workflow follows a defined sequence:
- A Reconnaissance agent maps request paths to the parts of the codebase that handle them.
- Hunter agents then target specific sections of customer-authorized code, looking for vulnerabilities and pulling in relevant network context as needed. Context from active or recently targeted routes can focus attention, but it cannot establish that a vulnerability exists — every finding must be corroborated by evidence in the source code.
- A validation stage checks proposed mitigations before assigning each vulnerability an initial risk rating based on source code alone. Network evidence can raise that rating further when an affected endpoint carries significant traffic or shows signs of active probing.
The output is a prioritized list of findings, each with a recommended code patch and, when evidence supports it, a Cloudflare WAF Custom rule that can reduce exposure during review. When customers have authorized VDR to defend their zones, the rules are deployed conservatively, scoped around the method, path, and request details needed to reach the vulnerable code. If a route pattern contains only variables and wildcards, no rule is suggested — VDR would rather miss a possible connection than claim one the evidence cannot support.
The HTTP method override bypass example in the diagram above demonstrates this signal correlation: source finding maps to production route, traffic and security activity determine priority, and a WAF rule is scoped to reduce exposure while the code patch is reviewed and shipped.
Model Boundaries and Validation
Safety controls are central to the design. When a customer authorizes an investigation, the harness runs on Cloudflare while model prompts are sent from Workers through Cloudflare AI Gateway to OpenAI Daybreak models running on OpenAI servers. GPT-5.6 Cyber operates during reconnaissance, hunting, and validation, returning responses to the harness. No model inference happens at Cloudflare's edge, and the model cannot apply any patch or rule it proposes.
Investigations remain narrow by design, limited to cache the source code and evidence the customer authorizes. Before context reaches the model, VDR strips out what the investigation does not need and applies any redaction controls configuration for the engagement. The harness treats source code, logs, and request metadata as evidence to inspect, not instructions to follow.
Tool access follows the same boundary:
- Every call is logged and checked against the investigation's access policy before execution.
- Each patch or rule proposal must pass checks implemented outside the model.
- The workflow halts, before reaching customer review, if any check fails.
Nothing goes to review until it clears the checks and Cloudflare's team validates the output. For edge-defense suggestions, validation includes checking rule syntax against synthetic fixtures, not customer traffic. Failed or ambiguous results are withheld and routed for diagnosis. Passing these checks still leaves the environment unchanged — the prepared source patch and WAF rule go to the customer only after all validation steps complete.
Early Access
Vulnerability Discovery and Remediation is available by invitation during early access through Cloudflare's Managed Defense team. Each engagement starts with a single application whose codebase the customer authorizes for investigation. Connecting findings to production requires authorized read access to the Web Assets operation inventory, relevant WAF controls, and Workers Trace Events Logpush where available. The investigation is semi-automated — customers review every result before deciding whether to test or deploy any change.
