Privacy and security

wgw-deploy is a static deploy service. Hosted deploys use https://deploy.wgw.lol as the API and publish files through Cloudflare Workers Assets behind wgw.lol domains. Self-hosted installs move that same responsibility into your own Cloudflare account.

This page describes the current implementation. It is not legal advice.

What is sent on deploy

When the CLI deploys a project, it reads the selected deploy directory, builds an asset manifest, and uploads deployable static files. The CLI ignores common local-only paths before deploy, including .git, node_modules, .cache, .turbo, .wrangler, coverage, .env*, common credential files, local databases, logs, private keys, certificates, and SSH-related files.

That ignore list is a guardrail, not a secret scanner. Do not put production secrets in a static deploy directory.

The hosted service stores or handles:

Static asset contents for the files you deploy.
Asset manifest data: public paths, asset hashes, and asset sizes.
Project metadata: generated name, suffix, project slug, assigned domain, project hash, anonymous fingerprint, API token hash, creation time, optional expiration time, revision ids, latest deploy time, latest manifest signature, and optional Cloudflare custom hostname id.
Temporary deploy preparation records for in-progress deploys.

The hosted service does not store your project source tree unless you deploy it as static output.

The service DOES NOT store your static files on R2 or KV, they are directly uploaded to the Cloudflare CDN, it’s what stores and serves them. The wgw.lol domains does not even serve them from worker code, the worker is not even hit, the Cloudflare CDN does the serving and caching.

Tokens and ownership

Each project gets a generated API token. The token is returned to the CLI once. The hosted API stores only a hash of that token and checks future requests with a bearer token.

Project operations also include:

projectHash, derived from the local project path and deploy directory.
anonFingerprint, a persistent pseudonymous 64-character hash produced by the CLI from local machine characteristics.

The raw machine inputs used to build the fingerprint stay local. The API receives only the hash, but that hash can still correlate projects created from the same machine.

The CLI stores local project state, including the project API token, under:

$WGW_DEPLOY_CONFIG_DIR, when set.
$XDG_CONFIG_HOME/wgw-deploy, when set.
~/.config/wgw-deploy, by default.

Treat that local state as a credential.

Retention

Anonymous hosted project metadata is created with a 7-day expiration. Assigning a non-default domain removes that expiration while the domain is assigned. Removing the assigned domain later resets the project to its generated domain and starts a fresh 7-day metadata expiration.

Deploy preparation records expire after 1 hour. If a deploy is prepared but not completed in time, the API rejects completion as an unknown or expired deploy.

Project deletion removes the project metadata, removes the project from the published manifest, republishes the static Worker, and deletes the external Cloudflare Custom Hostname when one is known. The current implementation removes references to deleted project assets from the manifest; Cloudflare’s handling of unreferenced asset blobs is part of the underlying Workers Assets platform.

Public deploys

Deploys are private by default in the unlisted sense: wgw-deploy does not index, list, train on, or analyze deployed sites or assets. Deploy URLs are still public bearer-style links. wgw-deploy does not add password protection, user authentication, origin access control, or private preview auth to deployed static files.

Revision URLs are also public. For wgw.lol domains, revisions use revision subdomains. For external domains, revisions use the /_rev/<revision>/ path.

Cloudflare dependency

Hosted deploys depend on Cloudflare Workers, Workers Assets, KV, and Custom Hostnames. Availability, request handling, TLS issuance, asset serving, abuse controls, and platform limits all depend on Cloudflare.

Self-hosting moves the Cloudflare account, zone, Worker, KV namespace, API tokens, routes, observability, and platform risk to you.

API security boundaries

The deploy API accepts CORS requests from any origin so the CLI and browser-based clients can call it. Mutating project routes still require the project bearer token plus matching project ownership fields.

The API is built for the CLI and should be treated as internal and unstable. Use the CLI unless you are intentionally tracking the current source.