FL-026HighSecurity
What it requires. Flows must not contain credential material in any value: no API keys, tokens, passwords, or secret-shaped literals in assignments, formulas, or action inputs.
Why it matters. A secret stored in flow metadata is visible to anyone who can open the flow, travels with every metadata retrieval, and lands in version control. Named Credentials exist to hold authentication outside metadata.
How to fix it. Move authentication into Named Credentials or External Credentials and reference them from the action. Rotate any secret that has been present in metadata.
Is this rule worth checking?
Votes and comments are published here. We read them, and we publish what we change with the reasoning — a vote does not move a rule on its own.