DLP payload decryption key

The private key for this deployment's DLP payload logs. Paste it into the dashboard when you want to show the room the actual value that tripped a policy, rather than the name of the policy that stopped it.

0INbdyJKutVjA4E4AM+unE9knOYgb0Y9tgrDKDApP30=

Blurred so it is not readable from the back of the room or in a screenshot. Reveal takes the blur off; Copy works either way.

Showing a match

In Zero Trust → Insights → Logs → HTTP request logs, find a DLP row and expand it. Any of the walkthrough's blocked steps will do.
Select Decrypt payload log.
Paste the key above and select Decrypt. You get the id of the DLP profile that matched, followed by the payload: the match itself plus 75 bytes of context either side of it.

Cloudflare stores neither the key nor the decrypted payload — the decryption happens in your browser, which is why it asks every time.

What you will see

Matches are masked at detection time, before they are encrypted, so the masking level is a property of the log rather than of how you read it. This deployment is set to Partial Mask:

Level	A social security number reads as	What it is for
Full Mask	`*--****`	The whole match is hidden. The default, and not much use on stage.
Partial Mask ← this one	`*--6789`	A quarter of the match is shown - enough to recognise the value.
Clear Text	`123-45-6789`	The entire match, unmasked.
Default	—	Whatever DLP's own default behaviour is for the account.

Set with DLP_PAYLOAD_MASKING in config.sh, then re-run node scripts/wire-dlp-payload-key.mjs. It applies to matches logged from that point on.

This key is published, and that is a deliberate choice for a lab

This page has no authentication in front of it. Anyone with the URL can decrypt any payload this tenant has logged, and every page on this site is public.

That is an acceptable trade here and nowhere else: the tenant is disposable, every person, address and figure in it is synthetic, and the key is generated fresh per deployment and dies with the lab. In an account with real data this key belongs in a secret store, and this page should not exist.

Re-running the key script does not rotate the key, on purpose. A new key makes everything already logged permanently unreadable — Cloudflare cannot recover it, having never had the private half. Rotation is behind --rotate.