Why automation accounts are a security target
An automation platform holds working credentials for your email list, CRM, spreadsheets and payment tools in one place. Anyone who can sign into it, or who obtains a token or webhook URL, can often read or change data in all of those systems. The checklist below focuses on the controls Make and Pabbly Connect actually document, plus general secrets-handling practice from OWASP.
This guide is for a small team: a founder, a virtual assistant, a freelancer who built the scenarios. Larger organizations will also need single sign-on and audit policies that are outside this scope.
1. Treat every connection as shared
Make says all users in your team in Make can use and manage any connections you create in that team, and warns you to use your personal third-party account and credentials carefully when your team has other users. [1] On Teams or higher plans, Make suggests creating a separate team where you are the only member for connections that should stay personal. [1] The My connections filter shows only connections you created, which makes a quick audit easy. [1]
Practical rule: connect business apps with a dedicated service or shared business account where the app allows it, not your personal mailbox. If a connection must use a personal login, keep it in a team only you belong to.
2. Scope tokens to what the modules need
OWASP's guidance is that secrets should have the minimum privileges required for their use. [11] Make's app pages show what that looks like in practice. For an Airtable personal access token, Make says to choose at least the most frequently required scopes: data.records:read, data.records:write and schema.bases:read. [6] Start there and add a scope only when a module fails for lack of it.
Some connections are broad by nature. Make's Google Sheets setup for a custom OAuth client asks for the spreadsheets and drive scopes. [7] That is access to the Google account's spreadsheets and Drive, so use a Google account that only holds the files the automation needs.
When you edit a key-based or OAuth connection, Make warns that it cannot ensure the edited connection has the scopes every module needs, and a module with insufficient scopes ends the scenario with an error. [1] Test each scenario that uses the connection after changing it.
| Connection | Documented scope or setup | Least-access move |
|---|---|---|
| Airtable token | data.records:read, data.records:write, schema.bases:read [6] | Limit the token to the bases the scenario uses |
| Google Sheets (custom OAuth client) | spreadsheets and drive scopes [7] | Connect a Google account that only holds automation files |
| Any API key | Make cannot verify scopes after you edit a connection [1] | Create a key just for Make; never reuse your admin key |
3. Give people the smallest role that works
Make's team roles range from full control to read-only. [2] Only plans at or above Teams can have multiple teams and manage roles; on lower plans the organization has one team and you cannot manage roles within it. [2] If several people need access and you are on a lower plan, everyone in the team has the same access to connections.
Pabbly Connect says the team member feature is not available on monthly plans; the Unlimited and lifetime plans include unlimited team members and shared folders with access permissions. [10]
| Make team role [2] | What it can do | Give it to |
|---|---|---|
| Team Admin | Full access including member management, audit logs and team deletion | The owner and one backup |
| Team Member | Full access to team-owned resources; cannot manage members or settings | People who build scenarios |
| Team Operator | Read-only, but can activate, deactivate and schedule scenarios | Someone who pauses a scenario during an incident |
| Team Monitoring | Read-only access to selected team information, logs and usage; cannot edit or run scenarios | A bookkeeper or client who reviews runs |
| Team Restricted Member | Deprecated legacy role | Nobody; Make says not to use it for new assignments |
4. Protect the login itself
Make supports two-factor authentication with an authenticator app such as Google Authenticator, Authy, Microsoft Authenticator or 1Password, enabled from the 2FA tab in your profile. [3] It provides one-time recovery passwords as a TXT file and says to save them somewhere safe, not on your mobile device. [3] To switch phones you disable 2FA first and re-enable it with the new device. [3]
Pabbly Connect lists two-factor authentication requiring access via a mobile device in addition to your password, and states SOC2 Type 2 and ISO 27001:2022 certification. [10] Certification describes the vendor's controls; it does not protect an account with a reused password.
5. Keep webhook URLs and keys out of shared places
Make says a webhook creates a URL that you can call from an external app or service, or from another scenario. [5] Anyone with it can send data in, so keep it out of public code, screenshots and help-forum posts. Make deactivates webhooks not connected to any scenario for more than 5 days. [5]
OWASP lists secrets hardcoded in source code in plaintext as a common problem and recommends documenting who has access to a secret and how it is rotated. [11] Apply that to your SOP doc: write where the key lives, who owns it and when it was last rotated, and keep the key value itself out of the document.
6. Decide how long run data should live
Make keeps several kinds of run data. Scenario run history retention depends on your plan. [8] Webhook logs are kept for 3 days, or 30 days on Enterprise. [5] Stored incomplete executions, which include module input and output data up to the failure, are encrypted and kept 30 days (60 on Enterprise). [9]
For scenarios that move sensitive personal data, Make's Keep data confidential setting means Make won't retain that data. [4] The trade-off is real: with it on, failed runs are not saved as incomplete executions and cannot be reprocessed. [9] Use it where privacy outweighs easy recovery, and add an error route that alerts you instead.
Quarterly checklist
- 2FA is on for every person with access to Make or Pabbly Connect, and recovery codes are stored off the phone. [3][10]
- Every connection has a named owner; personal-account connections sit in a team only their owner uses. [1]
- Tokens use the narrowest documented scopes; no admin keys are used for automations. [6][11]
- Each person has the least powerful role that fits; nobody holds the deprecated Restricted Member role. [2]
- When someone leaves: remove them, then rotate or revoke every key and reconnect every connection they created. [11]
- Unused webhooks and connections are deleted; Make requires deleting a webhook before deleting the connection it uses. [1]
- Scenarios carrying sensitive data have Keep data confidential on, with an alert route for failures. [4]
Questions before you decide
Can my teammates use my Google or email connection in Make?
Yes, within the same team. Make says all users in your team can use and manage any connections you create in that team, and suggests a separate team where you are the only member on Teams or higher plans.
Does Make keep the data that passes through my scenarios?
Some of it, for a while. Run history retention depends on your plan, webhook logs are kept for 3 days (30 on Enterprise), and stored incomplete executions are kept 30 days (60 on Enterprise). The Keep data confidential setting tells Make not to retain that data.
Does Pabbly Connect support two-factor authentication?
Pabbly's pricing page lists two-factor authentication as an extra layer of security requiring access via a mobile device in addition to your password, and states that Pabbly is SOC2 Type 2 and ISO 27001:2022 certified.
How often should I rotate API keys?
The OWASP Secrets Management Cheat Sheet says rotating secrets limits how long stolen credentials stay useful, recommends automating rotation where possible, and says secrets that are no longer needed or may be compromised should be revoked. Set a calendar reminder and rotate at least when someone with access leaves.
Sources & verification
Product details and prices can change. Check the linked provider before buying.
- Make Help: Connect an application Accessed 29 Oct 2026
- Make Help: Teams Accessed 29 Oct 2026
- Make Help: Two-factor authentication Accessed 29 Oct 2026
- Make Help: Scenario settings Accessed 29 Oct 2026
- Make Help: Webhooks Accessed 29 Oct 2026
- Make Apps: Airtable Accessed 29 Oct 2026
- Make Apps: Google Sheets Accessed 29 Oct 2026
- Make Help: Scenario history Accessed 29 Oct 2026
- Make Academy: Incomplete executions Accessed 29 Oct 2026
- Pabbly Connect pricing and features Accessed 29 Oct 2026
- OWASP Secrets Management Cheat Sheet Accessed 29 Oct 2026
Sources link directly to providers. Product buttons may use separately labeled affiliate links. Read our disclosure.