fix: enforce cloudflare token/key format validation

- Reject API key-shaped values in Cloudflare api_token

- Validate Cloudflare api_key as 32-character hexadecimal format

- Add UI form validation to prevent token/key cross-input

- Update API and UI changelog entries for the current PR

api/CHANGELOG.md

@@ -38,7 +38,7 @@ All notable changes to the **Prowler API** are documented in this file.
 - Attack Paths: scan no longer raises `DatabaseError` when provider is deleted mid-scan [(#10116)](https://github.com/prowler-cloud/prowler/pull/10116)
 - Tenant compliance summaries recalculated after provider deletion [(#10172)](https://github.com/prowler-cloud/prowler/pull/10172)
 - Security Hub export retries transient replica conflicts without failing integrations [(#10144)](https://github.com/prowler-cloud/prowler/pull/10144)
-- Cloudflare provider secrets now reject API key format in `api_token` credentials [(#10195)](https://github.com/prowler-cloud/prowler/pull/10195)
+- Cloudflare provider secrets now reject API key format in `api_token` and non-key values in `api_key` credentials [(#10195)](https://github.com/prowler-cloud/prowler/pull/10195)
 
 ### 🔐 Security
 

api/src/backend/api/tests/test_serializers.py

@@ -2,7 +2,11 @@ import pytest
 from rest_framework.exceptions import ValidationError
 
 from api.v1.serializer_utils.integrations import S3ConfigSerializer
-from api.v1.serializers import CloudflareTokenProviderSecret, ImageProviderSecret
+from api.v1.serializers import (
+    CloudflareApiKeyProviderSecret,
+    CloudflareTokenProviderSecret,
+    ImageProviderSecret,
+)
 
 
 class TestS3ConfigSerializer:
@@ -150,3 +154,22 @@ class TestCloudflareProviderSecret:
         )
         assert not serializer.is_valid()
         assert "api_token" in serializer.errors
+
+    def test_valid_api_key_and_email(self):
+        serializer = CloudflareApiKeyProviderSecret(
+            data={
+                "api_key": "144c9defac04969c7bfad8efaa8ea194",
+                "api_email": "user@example.com",
+            }
+        )
+        assert serializer.is_valid(), serializer.errors
+
+    def test_invalid_api_key_with_token_format(self):
+        serializer = CloudflareApiKeyProviderSecret(
+            data={
+                "api_key": "Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY",
+                "api_email": "user@example.com",
+            }
+        )
+        assert not serializer.is_valid()
+        assert "api_key" in serializer.errors

api/src/backend/api/v1/serializers.py

@@ -1722,6 +1722,14 @@ class CloudflareApiKeyProviderSecret(serializers.Serializer):
     api_key = serializers.CharField()
     api_email = serializers.EmailField()
 
+    def validate_api_key(self, value: str) -> str:
+        if not re.fullmatch(r"[a-fA-F0-9]{32}", (value or "").strip()):
+            raise serializers.ValidationError(
+                "Invalid Cloudflare API Key format. "
+                "Use a 32-character hexadecimal Global API Key."
+            )
+        return value
+
     class Meta:
         resource_name = "provider-secrets"