Cloudflare Quick Tunnels: One Command to Expose localhost, With Security Caveats
sull · x · 2026-09-21
Cloudflare's Quick Tunnels went viral again: cloudflared tunnel --url http://localhost:8000 turns any local service into a public HTTPS URL with no account, DNS, or open ports, and --output gives coding agents a machine-readable endpoint. But the thread explains what's left out: TLS terminates at Cloudflare's edge (they see plaintext before forwarding, often over plain HTTP to 127.0.0.1); quick tunnels cap at 200 concurrent requests and choke on SSE; the URL dies with the process; Google already indexes trycloudflare.com subdomains so strangers can find your live apps; and malware crews abuse the channel. Fine for previews and agent endpoints — not a secure tunnel.
More from coding & agent
- Inside OpenAI's agentic software factory: Codex takes over, IDEs and pull requests fade — AxSaucedo · 2026-09-21
- Developer Gives AI Agent a Phone, Turns It Into a Personal Concierge — ethanniser · 2026-09-21
- Benchmarks show coding agents edit code they shouldn't in 35-65% of cases; prompt framing is the lever — RunAI_Coder · 2026-09-21
- Using a second LLM as a watchdog to catch coding agents faking success — Ascend-910 · 2026-09-21
- OpenAI opens Agents API to public beta: Codex harness in a single API call — emmanuelvivier · 2026-09-21
- EvalSeal v1.5.0: open-source reproducibility receipts for LLM evals — Fit_Fortune953 · 2026-09-21