A connection reference nothing uses

Connection reference with no flow binding.

A connection reference exists but no flow binds to it. Not an active risk alone; the privileges of the underlying connection are the concern if it is ever re-bound.

List connection references and check each against the set actually bound by a flow. Anything unreferenced is a candidate for deletion, and worth rotating first if the connection underneath carries broad privilege.

Delete it if genuinely unused, and rotate any broad or secret-bearing connection underneath.

This one is environment health, so it carries a plain label and no control mapping. Presenting an operational gap as a security finding would make the real security findings harder to trust, so we keep the two apart.

• A plugin step that re-triggers itself on every save
• Two plugin steps at the same execution order writing one column
• A plugin registered twice on the same message
• An update plugin step with no filtering attributes