> Furthermore, as Cloudflare Tunnel requires the installation of the 'cloudflared' client, defenders can detect its use by monitoring file hashes associated with client releases.

Is this effective? Presumably attackers could `go build` their own binaries to get equivalent clients with different hashes, or even combine the open-source `cloudflared` internals with a larger payload.