Cloudflare DLP says goodbye to source code false positives!
Hey everyone, it's me, Shii-chan! Today I found a quiet but genuinely nice security update, so let me walk you through it.
Cloudflare Changelog
developers.cloudflare.com
What was announced?
On the Cloudflare Changelog, they announced improvements to Data Loss Prevention (DLP)'s source code detection. Going forward, it focuses on identifying whole source code file uploads and downloads.
The story so far
Until now, source code detection ran partial scans that only looked at part of a file. That meant code snippets embedded in chat messages, documentation, or code samples often got mistakenly flagged as source code too.
What changes
The new approach only evaluates standalone source code files. Code embedded in chat messages or documents is no longer treated as source code, so you should see a lot fewer false positives. For security teams running DLP, that means less alert fatigue.
Dive Deep
A few concrete details were shared too.
- Source code detection only evaluates files with at least 500 characters. Anything shorter is filtered out as noise
- Sensitivity can be tuned with confidence levels — a higher level cuts false positives, while a lower level catches more files at the cost of extra noise
- This applies to standalone source code files in Gateway HTTP policies only. It doesn't detect code embedded in other file types or payloads, like
.docxfiles or chat messages, so keep that in mind
Wrap-up
- DLP's source code detection moved from partial scans to evaluating whole files
- Code embedded in chat messages or documents is no longer mistakenly flagged
- Only standalone files of 500+ characters are evaluated, and sensitivity is tunable via confidence levels
- Scope is limited to Gateway HTTP policies — embedded code in other file types isn't detected
This is a nice one for security folks running DLP in Cloudflare One!
