A client asked me to look over their setup last year, a small business that had wired together a form tool, a spreadsheet, and a notification service using one of the popular no-code automation platforms. Nobody on the team thought of it as part of the app's security picture. It was just plumbing, glue between tools they already trusted individually.
What I actually found
The automation used a webhook to receive form submissions and push them into a spreadsheet, then trigger a notification. The webhook URL, generated by the automation platform, had been shared in a team chat months earlier so someone could test it, and it had never been rotated since. It was also referenced, in plain text, in an old internal document that was more widely accessible than anyone had thought about.
That URL accepted any properly formatted request from anyone who had it, with no additional check on who was sending it. In practice, that meant anyone with the link could push fake form submissions directly into the spreadsheet, or, depending on what else the automation was wired to do downstream, potentially trigger other steps in the chain.
Why nobody had thought to check this
Each individual tool in the chain, the form, the spreadsheet, the automation platform, is a reputable, well-built product. Everyone involved reasonably trusted each piece on its own. What nobody had done was think about the connections between them as their own thing with its own security properties, separate from the security of any individual tool. The automation platform did exactly what it was built to do. The gap was in how the pieces were wired together and who still had access to that wiring.
What this looks like more broadly
This isn't specific to one platform. Any time you connect two systems with a webhook, an API key, or a shared automation, you've created a new access point that doesn't automatically inherit the security thinking either individual system has. It's easy to focus entirely on 'is my app secure' and 'is this third-party tool secure' while never asking the separate question: 'is the connection between them secure, and who currently has the ability to use it.'
What actually changed after that check
- The webhook got regenerated, and the old one was invalidated, closing off anyone who still had the leaked link.
- Nobody shares automation URLs in chat anymore. They go into the team's password manager like any other credential.
- Once a quarter, someone actually lists every active automation and webhook connection the business has, and asks whether each one is still needed and who could currently misuse it.
- Any automation that can trigger a real action downstream, not just log something, gets treated as sensitive by default, regardless of how minor the individual tools involved feel.
The tools weren't the problem. The wiring between them, and nobody treating that wiring as something with its own risk, was. It's an easy category to overlook precisely because each individual piece feels solved already.