Review Cloudflare Worker source and optional wrangler.toml for hardcoded secrets, unsafe CORS, missing admin auth, sensitive logging, and dynamic code execution.