Internal-only Worker still reachable on its default workers.dev URL — which public triggers need disabling?

A Worker is intended to be invoked only through a Service Binding from another Worker, yet every deployed Worker also gets a default <name>.<account-subdomain>.workers.dev URL that exists independently of any zone route or custom domain. That makes a supposedly internal Worker publicly reachable unless the route is explicitly disabled.

The configuration surface is split across several places: the workers_dev setting in Wrangler (whose key name and default behavior vary by Wrangler version), separately controlled preview URLs, plus any zone routes or custom domains attached in the dashboard or via the API. Workers also have no built-in authentication, so a Service Binding alone does not remove the public URL — protection would otherwise require Cloudflare Access on a controlled hostname or an in-Worker check such as a shared-secret header.

The open decision is whether the CI pipeline should default new Workers to workers_dev = false and opt in to public URLs only for deliberately internet-facing services, instead of relying on manual per-Worker toggles and audits.

Specific questions:

• For a pinned Wrangler version, which exact keys (workers_dev, preview_urls) and defaults apply, and does disabling the production workers.dev route also cover preview URLs?
• After a CI deploy, what is the reliable way (dashboard Triggers view, API, or wrangler CLI) to confirm which public triggers are active on a Worker?
• Does a Service-Binding-only Worker keep functioning end-to-end once its workers.dev URL is disabled, and how should existing callers be inventoried before toggling, given the change is breaking?