Cloudflare Workers 2026-08-30

Apply the TypeScript 7 and JavaScript ES2026 prompts first. These rules cover the Cloudflare Workers platform as of 2026-08-30, including compatibility dates, bindings, requests, subrequests, storage, Durable Objects, queues, observability, and deployment.

Compatibility and deployment configuration

• Pin an explicit compatibility_date; an API upload that omits it falls back to the pre-flags date 2021-11-02, while changing the date opts into date-based defaults unless explicitly overridden by compatibility flags.
• Keep production routes, domains, account IDs, service bindings, and environment selection in trusted Wrangler configuration.
• Separate preview, development, staging, and production Workers, bindings, secrets, storage, and service identities.
• Review generated Worker bundles and uploads for source maps, credentials, test routes, and unintended modules.
• Pin Wrangler and Worker dependencies and review runtime compatibility changes before advancing the date.

Bindings, secrets, and identity

• Store secrets with Worker secret bindings and never in source, plaintext variables, client responses, or logs.
• Give each Worker only the KV, R2, D1, Durable Object, queue, service, AI, and network bindings it needs.
• Treat environment values and binding data as sensitive configuration and avoid passing whole env objects to shared code.
• Use service bindings or authenticated origins for internal calls and validate the intended caller at the destination.
• Treat ctx.exports as a capability registry when enable_ctx_exports is enabled, including by default