A plugin that calls out to an endpoint no admin surface lists

Plugin code calls an external endpoint registered nowhere.

A plugin's compiled code calls an external endpoint directly, so the destination appears in no admin surface: not the Plugin Registration Tool, not a solution export, not an outbound connection inventory.

Calling out from code is supported and common, so this reports the configuration rather than asserting it is wrong. What makes it worth knowing is that the environment sends data somewhere no admin surface lists, which surfaces during incident response, tenant migration and vendor review as a gap nobody knew existed. Severity is High where the calling step runs synchronously or fires on Retrieve, Medium otherwise. Only destinations written as literals are detectable, so treat the result as a floor: a URL built at run time, or a call inside a library outside the uploaded assembly, is not counted.

There is no admin surface for this, which is the finding. Nothing in the Plugin Registration Tool, a solution export, or a connection inventory will show it, because the destination exists only inside a compiled assembly. By hand it means decompiling the assembly or searching its source for outbound HTTP calls. Only destinations written as literals are findable either way, so whatever you assemble is a floor rather than a complete list: a URL built at run time, or a call inside a library that is not part of the uploaded assembly, leaves no trace to find.

Confirm the destination is expected and owned, record it in your integration inventory, and move it to a registered service endpoint where the pattern allows.

This is a security finding that carries no SOC 2, ISO 27001, NIST 800-53 or CMMC reference. That is a decision rather than an omission. Pathix maps a finding to a control only where the mapping is defensible to an assessor, and a stretched one would undermine every mapping that is real.

• A credential stored in a plugin step's unsecure configuration
• A webhook or service endpoint using plaintext HTTP
• A webhook registered without any authentication
• An HTTP-triggered flow anyone with the URL can run