.assetsignore decides what a Cloudflare Worker publishes

Cloudflare Workers can serve a static site straight from a repository. What I hadn’t realised: every file in the assets directory gets published, including dot-folders like .git and anything else sitting in the repo, such as internal docs or tooling.

That matters most for plain HTML repos with no build step. If Wrangler generates the config for you, it points the assets directory at ., the whole checkout.

The fix: .assetsignore

Put a file named .assetsignore in the root of the assets directory. It uses the same pattern syntax as .gitignore, and anything it matches is never uploaded:

# Never upload these as public assets
.git
.git/**
.claude
.claude/**
CLAUDE.md
wrangler.jsonc
worker.js
tools
tools/**
.assetsignore

A ten-second check after any deploy

Ask for something that should never be public and make sure it 404s:

$ curl -sI https://example.com/.git/HEAD | head -1
HTTP/2 404

Worth doing whenever a deploy tool picks the defaults for you. Generated configs are convenient, and generous about what they include.