Why does my workflow show missing configuration or security warnings?

TeleportHQ checks your workflows while you build them. A yellow issues button at the top left of the editor, such as 2 issues, means some steps still need something, such as an API key, a page or an element, and those steps will fail until you add it; it also counts links on your site that lead nowhere. A security issues button means a workflow could expose secrets or run unsafe code or SQL; red, critical issues block publishing. A Not exported badge on a workflow card means the workflow can't run at all. Click any of them to see what's wrong and jump to the step.

"N issues" at the top left of the editor#

The yellow issues button counts everything your TeleportHQ project still needs set up: "settings it still needs, or links that lead nowhere". Missing settings don't stop you from publishing, but the affected steps fail on your live site.

1. At the top left of the editor, next to the logo, click the yellow button, for example 2 issues.
2. The Issues window opens, with a line such as "2 things to fix for your project to work correctly". It lists the problems in sections. Fix each one:
   • Setup Requested by the Assistant: "The assistant opened these setup cards — add your credentials to finish." The AI Assistant needs a service connected before it can add a step. Open the card and enter the credentials.
   • Missing Credentials: a service has no key, or its email steps still send from the stand-in address noreply@yourapp.com, which sign-in fills in before any service is set up and which no service sends from. Expand its card (marked Not configured), enter the key, and for email services the Sender details, then click the Save button with the service's name. Steps that sent from the stand-in address then send from the address you typed. The chips under the card link to the workflows that use it. The same section lists a sign-in provider, an external data source or Incoming webhooks whose key or signing secret is missing from your project's Secrets, for example in a cloned project: enter the value in its card.
   • Missing Page / Element Selections: a step needs a page or element that isn't chosen or no longer exists. Click Configure from workflow and pick it in the step.
   • Broken Workflow Nodes: a step has settings that will misbehave, for example "Filter is missing its operator (=, !=, contains, …)." or "IF node has zero conditions." Click Open node in workflow editor and fix the setting.
   • Placeholder Values: a step still holds a value the AI left for you to replace, such as an API key or an address. The step fails as soon as the workflow runs. Click the card to open the step and type the real value.
   • AI models that were shut down: an AI step still uses a model its provider has shut down, for example "Answer questions uses o4-mini, which OpenAI has shut down; your site uses GPT-5.6 Terra instead. Pick a model in the step to choose another." The step keeps working: your published site uses the replacement from your next publish. Click Open step and pick a model, the replacement or another, to clear it. See How to use your own AI provider keys in your web app.
   • Missing State References: a step reads or writes a state that was deleted, for example "The state “cartCount” no longer exists on any page or component". Re-create the state with the same name, or click Open node in workflow editor and choose an existing state.
   • AI Assistant Chat: your site's chatbot has no AI provider key. Enter the key, or click Manage AI providers at the bottom of the window.
   • Broken links on pages, and broken links in Blog posts or Help Center articles: see How to find and fix broken links on your site.
3. When everything is fixed, the window says "Nothing to fix." and the button disappears. Click Done.

The button and the Issues window update by themselves when you change sign-in providers, data sources, webhook secrets or your project's Secrets. A key whose secret was deleted counts as missing again.

On the workflow canvas, a step with problems shows an orange warning icon. Point at it to see the Configuration Incomplete list. The Workflows icon in the left sidebar also shows a small warning icon.

In the Workflows panel, the filter button next to Search workflows... then carries an orange warning icon, with the tooltip "Some workflows need attention". Click the filter button and choose Misconfigured (N) to list every workflow that needs fixing, including the admin panel workflows the list hides by default.

"This workflow is no longer triggered by <element>." You cleared the element a trigger was linked to, so the step now needs an element again. Click Undo in the notice to link it back, or pick another element in the trigger. A step shows "This step no longer targets <element>." in the same case.

"N security issues" at the top left of the editor#

The TeleportHQ security issues button, with a shield, appears when TeleportHQ finds risky code in a workflow, usually in Custom JavaScript steps or raw SQL. It's red when at least one issue blocks publishing, and yellow when all are warnings.

1. At the top left of the editor, click the shield button, for example 1 security issue.
2. The Security warnings window has two sections:
   • Critical security violations, marked Blocks publish: "These violations block publishing. The deployed project would otherwise leak Teleport infrastructure secrets or escape the workflow sandbox." Examples: code that reads server secrets, lists all environment variables, or uses eval.
   • Security warnings, marked Warning: "Informational — these patterns don't block publishing, but it's worth reviewing what data they expose." For example, code that reads an environment variable or puts a workflow value straight into raw SQL.
3. Expand a card to read the explanation, the code line and a Fix hint.
4. Click Open the workflow editor and change the code.

When no issues are left, the window says "No security issues detected. Your workflows are clean." If you click Publish while a critical violation exists, TeleportHQ shows "Resolve the critical security violations before publishing." and opens the Security warnings window.

On workflow cards and steps, a shield icon marks the problem: "Security Violation" or "Security Warning". Point at it for details.

"Publishing Blocked" with forbidden SQL operations#

This TeleportHQ window appears when you publish a web app whose data steps use SQL that isn't allowed in workflows, such as DROP, ALTER or CREATE: "Your project cannot be published because 1 workflow node contains forbidden SQL operations that modify the database structure."

1. In Publishing Blocked, check the Affected nodes: list.
2. Click Go back and fix. TeleportHQ opens the step with the red icon.
3. Change the query to an allowed operation: SELECT, INSERT, UPDATE or DELETE.
4. To change your database structure, use Data Sources instead of a workflow.
5. Publish again.

A red Security: SQL Schema Leak icon on a data step means the SQL query travels through the visitor's browser. Put the SQL in the data step as fixed text and pass changing values as parameters ($1, $2, …). See How to save, update or delete database records with a workflow.

"Not exported" badge on a workflow card#

A TeleportHQ Not exported badge means the workflow is left out of your published site because it can never run. Point at the badge for the reason:

To list only these workflows, click the filter button next to Search workflows... in the Workflows panel and choose Not exported. Misconfigured lists the workflows with missing settings, admin panel workflows included.

A Disabled badge is different: you paused the workflow. Click the play button on its card (Enable workflow) to include it again.

My workflow shows no warnings but doesn't run#

• Publish again. Workflow changes reach your live site only after you publish.
• Check the web app slot. An uncovered web app stops running after its 7-day window. See Why does my web app need a slot?.
• Check the trigger. The Data Triggers (Item Added, Item Updated, Item Deleted) don't currently start workflows, and A Custom Event is Triggered doesn't start for events sent with Emit Custom Event. No warning tells you. Add the follow-up steps right after the step that changes the data instead, or share steps with a custom node. See the Workflow triggers and steps reference.
• Test the steps. Use Test this node… to run each important step and read the error. See How to test a workflow step.
• Add error handling. Add steps to the Workflow Error box, for example a Send Email or Slack step, so you're told when the workflow fails. TeleportHQ has no log of your live site's workflow runs: the Test runs tab only lists the tests you ran in the editor.

For the full checklist, see Why isn't my workflow running?.