A password or API key written into a Power Automate flow

Flow has a secret written into its definition.

A credential-shaped literal sits in the flow's own definition rather than in a connection or Key Vault. A flow definition is a solution artifact, so the value travels into every solution export and into source control, readable by anyone who can export the solution.

Pathix reads the definition in memory and discards it, and reports a neutralized label (the pattern type and the redacted length), never the value. It reports what a value LOOKS like and does not test whether the credential still works. A value written as an expression reference, which is how a flow is meant to pull a secret, is deliberately not reported. Cloud flows and agent flows are scanned for this; classic workflows, business rules, actions and business process flows are not, so a clean result does not cover those.

Export the solution and read each flow's definition JSON for credential-shaped literals: connection strings, passwords, API keys, shared access keys, bearer tokens, private keys. Searching the unpacked export is faster than opening flows one at a time, and it is the same file anyone else with export rights can read.

Replace the literal with a reference: let the connection hold the credential, or read it from Key Vault, then rotate the exposed value.

These mappings are indicative. Pathix detects a condition relevant to a control. It does not certify your compliance, and a finding is not an audit opinion. You stay responsible for your control environment.

This condition produces evidence for IA.L2-3.5.10 (Level 2: store and transmit only cryptographically protected passwords), for the Dataverse system in your assessment scope. A flow definition is a solution artifact, so the credential is in every export and in whatever source control holds them. Anyone who can export the solution can read it, and so can anyone holding a past export, which is why rotation is part of the fix rather than an afterthought.

Pathix is not a CMMC compliance platform. It does not assess the rest of your environment, mappings are indicative, and assessment outcomes rest with your assessor.

• A credential stored in a plugin step's unsecure configuration
• A webhook or service endpoint using plaintext HTTP
• A webhook registered without any authentication
• An HTTP-triggered flow anyone with the URL can run