The risk in a growing business is often not a sophisticated adversary. It is a helpful connection that was stood up quickly. A token pasted into a no-code tool. A service account that can read every record because that was easier than scoping it. A webhook nobody owns. These choices are understandable. They are also how ordinary operations become difficult to trust.
Secrets that live in the wrong place
API keys in browser code, chat history, screenshots, and repositories are a recurring pattern. Once a secret is in those places, the correct response is to rotate it, not to hope it was not copied. Integrations should read credentials from a server-side location with access limited to the people who maintain the connection.
Privilege that exceeds the job
A workflow that creates leads does not need permission to delete the CRM. A reporting job does not need write access. A document extractor does not need the entire file store. Least privilege sounds like a slogan until the day a compromised token can do less than everything.
Data moving without a contract
If nobody can say which fields leave a system, it is difficult to answer a customer, an insurer, or an internal question later. A short data contract — what is sent, where it goes, how long it is kept — is part of the integration, not paperwork to add afterwards.
- ▸Scope tokens to the objects and actions required.
- ▸Keep a named owner for each connection.
- ▸Log enough to explain a change without logging secrets.
- ▸Disable unused webhooks and abandoned test apps.
Security in integrations is mostly operational hygiene. It is also one of the highest-leverage places to reduce avoidable risk without slowing the business down.
