Privacy

Last updated 8 August 2026

murus is a command-line program that runs on your computer. It has no backend, no account system and no telemetry. We do not receive your Cloudflare credentials, your configuration, or a record that you ran it.

The murus program

murus makes network requests to exactly two hosts, both Cloudflare's: api.cloudflare.com and dash.cloudflare.com. There are no others. It sends no usage statistics, no crash reports and no version pings.

Credentials are stored in a single file on your machine, ~/.config/murus/credentials.json, written with owner-only permissions. They are read to authenticate to Cloudflare and are never transmitted anywhere else. Deleting that file removes the local copy; revoke the credential itself in your Cloudflare dashboard.

Your wrangler configuration is read from disk and compared against your Cloudflare account. It is never uploaded to us, because there is no us to upload it to.

Signing in with Cloudflare

murus is registered as a public OAuth client so you can authorize it from your browser. That exchange happens directly between you and Cloudflare. The authorization code is returned to a server listening only on your own machine (127.0.0.1), and the resulting token is written to the file described above.

Because it is a public client using PKCE, there is no secret held on our side and no point at which a token passes through infrastructure we control. We do not learn your Cloudflare account name, your email address, or that you signed in at all. Cloudflare's own privacy policy governs what Cloudflare records about the authorization.

You can decline to use our OAuth client entirely. murus accepts a client you register in your own Cloudflare account, or an API token you mint yourself.

This website

murus.dev is a handful of static files served from Cloudflare's network. There are no cookies, no analytics, no tag managers, no embedded third-party scripts and no fonts fetched from anyone else. Nothing here tries to identify you.

Cloudflare, as the host, processes standard request data such as IP address and user agent in order to serve and protect the site. We do not add analytics on top of that, and we do not build profiles from it.

Other places murus lives

The source code, issue tracker and release downloads are hosted by GitHub, whose privacy statement applies when you visit them. If you open an issue there, whatever you write is public. Please do not paste tokens, account identifiers or zone identifiers into one.

Children

murus is a tool for software developers and is not directed at children.

Changes

If this policy changes, the revision date above changes with it and the edit is visible in the repository's history like any other change.

Contact

privacy@murus.dev, or open an issue on GitHub. Security reports should go through private reporting rather than a public issue.