Understand what CF Guard Desk is, who it is for, which posture surfaces it covers, and how the local-first workflow differs from a SaaS security console.
- Product positioning and buyer fit
- Current capability surface
- Plan summary and staged launch notes
- Local-first workflow and evidence model
Applies to
WindowsmacOSLinux
Covers
SetupScansFindingsSecurityLicensing
Product overview
What CF Guard Desk is
CF Guard Desk is a desktop Cloudflare security posture console.
It is built to answer practical operator questions quickly:
- What is the current posture score?
- Which zones are most exposed right now?
- Where is active threat pressure highest?
- Which findings are critical or high confidence?
- What should be fixed first?
This product is not positioned as:
- a hosted control plane
- a generic Cloudflare dashboard wrapper
- a lightweight checklist linter
It is positioned as desktop-first Cloudflare audit software with local evidence handling.
Who it is for
CF Guard Desk is built for:
- consultants and agencies auditing multiple Cloudflare estates
- internal platform or security teams that need repeatable posture reviews
- solo operators who want local-first evidence and report-ready findings
Current capability surface
The current build covers:
- workspace and Cloudflare connection management
- token validation and capability inspection
- zone discovery
- Quick Scan, Full Audit, and Focused Rescan
- posture normalization before rules and scoring
- WAF coverage and rule quality analysis
- DNS exposure and hygiene detection
- bot pressure and attacked-path analysis
- cache risk and TLS or edge posture checks
- findings explorer, history, exports, diagnostics, and local notes
Why local-first matters
This product is built around a real boundary:
- Cloudflare credentials are sensitive.
- Audit findings often become client deliverables or internal evidence.
- Support bundles must be explicit and redacted.
That is why the app uses local persistence, OS-backed secret storage, vault gating, and no desktop telemetry by default.