Cloudflare DLP custom patterns can now call a Worker to grade matches

Cloudflare’s Data Loss Prevention service can now hand a match off to a Worker before deciding what to do with it. Custom pattern entries get a new validator type, under Validators > Custom functions in the dashboard, that calls a Worker instead of relying on DLP’s built-in proximity-keyword scoring alone.

The Worker exports a class named DlpValidationEntrypoint, extending DlpValidation from @cloudflare/zt-types, with a validate method. It receives the entry ID, match offsets, the request’s method and URL, and a base64-encoded excerpt of the match with surrounding context. It returns a score from -1 to 1 to nudge confidence up or down, 0 to leave it alone, or the string "veto" to reject the match outright. You can set fallback behaviour for when the Worker errors or times out.

export class DlpValidationEntrypoint extends DlpValidation {
  async validate(input: DlpValidationInput) {
    return { score: 'veto' }
  }
}

Why it matters: DLP’s built-in detection is generic, and keyword-proximity scoring produces false positives on anything domain-specific, an internal ticket ID format, a customer reference number that looks like a card number. Letting a Worker apply organisation-specific logic to a match before it triggers a policy means fewer false alarms without giving up the DLP rule entirely.