A service endpoint nothing triggers

Service endpoint or webhook with no plugin step binding.

An endpoint is registered but nothing triggers it. Not an active risk alone, but an over-permissioned or long-unused endpoint is worth cleaning up.

Cross-reference registered service endpoints against the steps that route to them. Unreferenced endpoints often still carry a live credential in their definition, which is the reason to clean them up rather than leave them.

Delete it if unused and rotate any credential baked into its definition.

This one is environment health, so it carries a plain label and no control mapping. Presenting an operational gap as a security finding would make the real security findings harder to trust, so we keep the two apart.

• A plugin step that re-triggers itself on every save
• Two plugin steps at the same execution order writing one column
• A plugin registered twice on the same message
• An update plugin step with no filtering attributes