Internal-only Worker still reachable on its default workers.dev URL — which public triggers need disabling?
A Worker is intended to be invoked only through a Service Binding from another Worker, yet every deployed Worker also gets a default <name>.<account-subdomain>.workers.dev URL that exists independently of any zone route or custom domain. That makes a supposedly internal Worker publicly reachable unless the route is explicitly disabled. The config
cloudflareworkers