Security rules

The Security category holds four rules that look for direct weaknesses in a flow definition or its connector usage. Security findings carry a 1.5 category multiplier in scoring.

SEC-01 — Hardcoded Secret (Critical)

What it checks. The inputs and outputs of every action for keys named like password, apikey, api_key, secret, token, connectionstring, client_secret, auth_key, access_token, or private_key followed by a value. A match is only flagged when the value is at least 12 characters and has high entropy (above 3.5), which filters out most ordinary words.

Why it matters. Anyone who can read the flow can read the secret, and it travels with every export or solution package.

What to do. Move the value to Azure Key Vault or an environment variable and switch to connection references instead of embedded credentials. Then rotate the secret; assume it is compromised.

CON-04 — Tenant Isolation Bypass (Critical)

What it checks. HTTP actions whose inputs contain an Authorization or Bearer header together with a GUID pattern, a combination that suggests a token referencing an external tenant.

Why it matters. A hardcoded cross-tenant token bypasses tenant isolation and any DLP policy.

What to do. Validate that tokens reference only your home tenant. Prefer managed connectors, which have tenant isolation built in.

SEC-04 — Direct Connection Usage (High)

What it checks. Whether the flow uses direct "connectionName" connections and has no connectionReference anywhere in its definition.

Why it matters. Direct connections are harder to manage, audit, and carry across environments.

What to do. Migrate connections to connection references, especially for solution-aware flows, and manage them centrally in the Power Platform admin center.

RPA-01 — PAD Not Patched (Medium)

What it checks. Whether the flow invokes Power Automate Desktop or RPA actions (connector names containing “desktop”, “pad”, “uiflow”, or “robotic”). The rule cannot see the PAD runtime version; it flags usage so you verify the patch level yourself.

Why it matters. Desktop flows run under a machine identity, and an unpatched PAD runtime is attack surface on that machine.

What to do. Update the PAD runtime to the latest supported version and verify it in the PAD console or machine group settings.

Last updated: July 27, 2026