A webhook or service endpoint using plaintext HTTP

Integration endpoint sends payloads over plaintext HTTP.

A service endpoint or webhook uses http, so record data, execution context, and any credential in the message cross the network unencrypted.

List your service endpoints and webhooks and read the URL scheme on each. Anything starting http rather than https is the finding, and any credential that has been travelling over it should be treated as exposed.

Re-register against https, verify the certificate, and rotate any credential sent in the clear.

These mappings are indicative. Pathix detects a condition relevant to a control. It does not certify your compliance, and a finding is not an audit opinion. You stay responsible for your control environment.

• A credential stored in a plugin step's unsecure configuration
• A webhook registered without any authentication
• An HTTP-triggered flow anyone with the URL can run