Cloudflare built an OAuth 2.1 library with Claude and published the prompts in git

Cloudflare engineers wrote workers-oauth-provider largely with Claude and kept the prompts in the commit history. A security expert later reviewed it and found real flaws, which makes this a useful case study.

Organization: Cloudflare
Industry: Cloud & Security
When: Jun 2025
Evidence: Independent
Agents and tools: Claude

Reported outcome

A working OAuth 2.1 provider library for Cloudflare Workers, written mostly by Claude and reviewed by Cloudflare engineers.

Yes, in commit history
Prompts public

Caveats

Checked or measured by a party with no stake in the result.

An independent review by Neil Madden found an implicit-grant flow (removed in OAuth 2.1) and a Basic-auth bug. Human review still matters for security code.
The library was labelled beta at the time.

What the agent does

Engineers described each feature to Claude, reviewed the generated code, and committed it. Commit messages include the prompts, so you can read how the library was built step by step.

What the review found

Neil Madden expected to dislike the code and wrote that he partly proved himself wrong. He still found problems a specialist would catch. One commit added the implicit grant for public clients, which OAuth 2.1 removed. Another missed a URL-encoding step in Basic auth.

What to copy

Keep prompts in commit messages. It makes AI-written code reviewable and teachable.
For security code, ask a domain expert to review the final result, not only the diffs.
Ask the agent to cite the spec section for every security decision.

Starter prompt

Written by us, inspired by this case.

Implement {feature} for our OAuth 2.1 server.

Rules:
- Follow OAuth 2.1 (draft-ietf-oauth-v2-1). Do not use flows it removes.
- For every security-relevant choice, add a code comment citing the
  spec section.
- List any part of the spec you were unsure about at the end of your reply.