How to Audit a Make.com Scenario for Leaked API Keys
Exposed secrets are one of the most common automation risks. Here is how to find and fix them with Xray Flow.
- 1
Generate a security audit
Enter your Make.com API key and scenario ID in Xray Flow and run the security audit. Xray Flow scans every module's configuration for secrets.
- 2
Review flagged secrets
The report lists hardcoded API keys, tokens, and passwords found in module settings, plus where they appear.
- 3
Rotate exposed credentials
For each leaked secret, regenerate it in the source service (e.g., Make.com Connections or the third-party provider) and update the module that uses it.
- 4
Re-run the audit
Run the audit again to confirm the scenario is clean. A second pass catches secrets that were missed or newly introduced.
- 5
Export the report
Save the audit as PDF or DOCX for your compliance records or to share with a client.
Frequently asked questions
What does the security audit actually check?
It scans module configurations for patterns that look like API keys, tokens, and passwords, and flags them for review. It also surfaces architectural and resilience issues.
Is the audit safe to run?
Yes. Your Make.com API key is used only for the duration of the request and is never stored on our servers.
How many audits are included on the Free plan?
The Free plan includes a limited number of security audits per month; Pro includes unlimited audits.
Last updated: July 2026