Start

Staging and fire drills

Mark a Cloudflare account as staging, run fire drills that execute a cap live and restore it automatically, and practise on a demo app.

A cap you have never seen fire is a cap you do not trust. SignalFlare gives you two ways to practise: staging accounts and fire drills.

Production and staging accounts

Every connected Cloudflare account is production unless you say otherwise. On the Accounts page, click an account’s environment badge to mark it as staging. Only owners and admins can change it, and every change is written to the audit log.

Mark an account as staging only if it serves no real users. A staging account is a real Cloudflare account: caps and drills change it for real.

Fire drills

A fire drill runs one action live, right now, whatever the budget says, then restores it automatically.

1. Open Kill switch, find the action and press Run fire drill.
2. Read the risk badge and the warning: what the action breaks, how to undo it, and the token scopes it needs.
3. Pick when to restore: 1 to 60 minutes, 10 by default.
4. On a production account, type DRILL <action name> to confirm.

What happens:

• The action executes against Cloudflare, exactly as it would at 100%. A webhook action sends cap.fired with drill: true.
• The execution log records it as a drill, with Cloudflare’s responses.
• Your channels get a “fire drill running” alert, and the audit log records who ran it.
• When the time is up, the next check restores it (checks run every 5 minutes), so allow one extra interval. You can press Restore earlier.
• If the automatic restore fails, it is retried twice more, five minutes apart, and you are alerted each time. After that, restore from the kill switch page or undo it in the Cloudflare dashboard.

A drill does not change whether the action is armed. While a drill is in place, a real breach waits for the restore instead of firing on top of it, and you cannot start another drill or arm over an unrestored cut.

If a drill fails, nothing was changed, and a real breach would have failed the same way. Fix the token scopes or the config and run it again. That is the point of a drill.

Only owners and admins can run drills, and they are rate limited.

Practise on a demo app

If you do not have a staging app, deploy ours. It is a tiny Worker with a static page, an /expensive endpoint that burns CPU, a cron trigger and a workers.dev URL, plus a load script to push estimated spend over a budget.

1. Deploy it to a separate Cloudflare account with Wrangler.
2. Connect that account to SignalFlare and mark it as staging.
3. Create a small budget, connect a write token with Account · Workers Scripts · Edit, and create a Take a Worker off workers.dev or Pause a Worker’s cron triggers action for the demo Worker.
4. Test it, then Run fire drill and watch the workers.dev URL stop answering until the restore.
5. Arm it and run the load script to see a real breach fire it.

Ask us at hello@signalflare.dev for the demo app source if you do not have it yet.

Every spend figure along the way is an estimate from sampled analytics: an early warning, not your invoice.