In-House Automation Built with AI: Where Are the API Keys? A Guide to Checking “Wild Code”

The automation works, but no one can explain it

A Slack reporting bot someone built last month is still sending messages as expected today. But its creator moved to another team, and when asked what permissions it uses to access Google Sheets and Slack—or whether API keys are embedded in the code—no one can give a definite answer.

AI coding tools have made it easy to build small internal apps and scripts quickly, but they do not automatically solve the job of explaining ownership, credentials, permissions, and execution records. Tines calls the phenomenon of AI-built software connecting to systems and data outside IT and security visibility “Wild Code.” This is not an official security classification, however; it is a product and market framing proposed by Tines. tines +1

The key takeaway is not how to stop automation. It is how to divide an architecture in which code directly holds secrets and calls external systems into connectors, isolated execution, and private-draft versus live permissions.

The risk grows from “connections without boundaries,” not AI

The first thing to check is not how much code AI wrote, but what connection permissions that code holds. In a survey of 2,000 senior IT, technology, and AI decision-makers across 33 regions and 19 industries from January through April 2026, IBM found that 77% said the pace of AI adoption is outstripping current governance capacity, and 70% said IT cannot keep up with the speed of technology deployment by business teams. This is not a measurement of unauthorized automation at a particular company, but it is a perception survey that highlights the operational problem of growing tools that are difficult to explain centrally. newsroom.ibm

The habit of handling credentials alongside code has also left traces in public repositories. GitGuardian reported finding 24,008 unique secrets in MCP-related configuration files on public GitHub in 2025, of which 2,117 were valid when checked. This cannot be generalized into an exposure rate for all internal automations, but it is enough warning that configuration files can be a leak path just like source code. blog.gitguardian

Generated code itself also needs review. Veracode had more than 100 LLMs complete 80 single-function tasks in Java, JavaScript, C#, and Python, then scanned the results with SAST. Known security flaws were detected in 45% of all model-task combinations. That does not mean 45% of complete real-world applications are vulnerable, but it supports the point that even small functions should not skip static analysis and permission review before deployment. veracode

What Tines 3B moves are credential and execution boundaries

The practical difference with Tines 3B is that it takes secrets out of workflow logic. Credentials such as API keys and OAuth tokens are stored in connectors rather than individual steps, and are attached to an external request when its request URL matches the pattern configured on the connector. According to the official documentation, secrets are injected at runtime through a proxy, so they are not directly exposed to builders, AI, or generated code. tines +2

This is not a structure that limits connectable services to a predefined Tines list. You can also create custom API key, OAuth, remote MCP, and database connectors. Safety therefore depends less on the product name than on who can create connectors and how tightly URL patterns and token permissions are scoped. tines +1

Start with a draft that needs no installation and makes no external transfers

The success criterion for your first run is not actually sending a Slack message. It is using sample automation information to find missing owners, credentials kept in code, and missing review dates in structured results—without causing any change in external systems.

The Explore free plan currently provides unlimited users, spaces, and connectors, three live workflows, and a one-time $50 AI allowance. Managed Claude and OpenAI providers are also configured by default, so you can start without a separate provider API key. Prices and availability may change. docs.3b.tines +1

1. Create an Explore tenant and sign in through the Tines 3B free-start path. Do not prepare real API keys or production data for this first test. tines +1
2. Open the General space or a personal space and find the “What do you want to do?” prompt box. The result of a new request is created in a private First draft. docs.3b.tines +1
3. Enter the request below.
   Create a manually run workflow that does not call external APIs. In the first step, output this sample JSON: {"name":"weekly-report-bot","owner":"","purpose":"Slack weekly report","systems":["Slack","Google Sheets"],"credential_location":"source_code","last_reviewed":""}. The next step must check owner, credential_location, and last_reviewed, then output missing or risky items as a JSON array to stdout. Do not make external requests, send messages, save files, or modify production data.
   This JSON and these decision items are examples for a side-effect-free first run, not metrics for evaluating product performance.
4. Do not click Run yet; first expand every generated step and connection. Check that there are no HTTP or API calls, Slack or email sends, file-saving steps, or production-data modification steps. If steps differ from your request, use chat to have them removed, then review the entire flow again. A draft can still call external systems when run manually. docs.3b.tines +1
5. When only side-effect-free steps remain, click Run on the starting step. Run executes the selected step and connected downstream steps together. Solo run runs only the selected step, so it is not suitable for this test, where you need to check the final review result. docs.3b.tines +1
6. Check the execution status and the stdout from the final step. It is successful if the status is Success and the final stdout contains structured results indicating a missing owner, the source_code credential location, and a missing last_reviewed value. Stdout is that step’s output and is passed to the next step’s stdin if a next step exists. docs.3b.tines +1
7. Keep it as a First draft even after checking the result. Schedule, web-request, and email triggers run automatically in the live version, so do not click Push live for this exercise. docs.3b.tines

When connecting a real API, narrow both the URL and permissions

Add an external connection only after the sample check is complete. A user with connector-creation permission should register least-privilege test credentials under Connectors, then tightly specify URL patterns for the host and path that will actually be called. Next, set a read-only or side-effect-free test URL and HTTP method to check the connection. If the test succeeds, its status appears as Active. docs.3b.tines +1

If you leave the test URL and method empty, the connection check can be skipped and the status may remain Untested. Untested does not mean the credentials actually work. If no safe test endpoint exists, do not validate directly against production data; set up a separate test environment first. docs.3b.tines

Consider pushing live only after the draft reads and writes exactly the data you expect. According to the official documentation, the Push live process includes pre-flight checks, including step testing, but users can continue publishing even if a check fails. Pre-flight checks are warning mechanisms, not absolute deployment blockers. docs.3b.tines

If you want to dig deeper

Making Tines 3B See how the Tines product team defines “Wild Code” as a problem and reflects it in the product architecture. tines.com

Credentials | Tines 3B Docs Learn how credentials are stored in connectors and why destination URL patterns matter. docs.3b.tines.com

Understand how your workflows run Review the difference between Run, which executes the whole flow, and Solo run, which executes a single step, as well as the per-step isolation model. docs.3b.tines.com