Operator notes on Cloudflare-native email.

Long-form writing about self-hosted email in D1, Workers-native routing, the REST API, and the parts of the platform that show up in the security review.

Cloudflare API token permissions, explained

The exact scopes Flowmails needs, the principle of least privilege, and the audit trail you can show your security reviewer.

Read the post →