I recently open-sourced Minvoice, a small invoicing app that runs entirely on Cloudflare Workers. Like every well-behaved open-source Workers project, it has a Deploy to Cloudflare button in the README: one click, and you get the repo forked to your GitHub, a D1 database provisioned, and the app running on your own workers.dev subdomain.
I clicked my own button to test it. The deploy went fine. The app came up, the setup wizard ran, invoices saved. Then I opened /admin on the fresh deployment and walked straight in, past no login screen of any kind. Every copy of my app deployed through that button had admin auth turned off.
How it happened
The deploy button does something that sounds reasonable: it reads your .dev.vars.example file, prompts the deployer for each entry as a required secret, and deploys those values with the Worker.
Here's what my .dev.vars.example looked like at the time:
