Security: how well your account is protected
Settings → Security checks your WrkLst account every day and scores how well it is protected: people who no longer use WrkLst, sign-ins without a second factor or from unexpected countries, unused API tokens and app connections, what AI assistants do, and presentation links that have been public for a long time. Each finding says what to do. This article describes WrkLst 10.
The page is for administrators: it names people, where they signed in and every credential of the account, so only roles with the Security Audit permission see it; the Administrator role has it.
The security score
At the top, the Security score shows how well your account is protected, from 100 down, with a grade. Severe findings weigh most; risks you have accepted do not count. Beside it you see how many findings are Critical and high, Medium, Low and info, and how many Accepted risks there are. The check runs by itself every morning; Check again runs it right away, for example after you have fixed something.
Findings
Findings lists what the check found, the most serious first; Show all findings opens the rest. Each finding has a severity (Critical, High, Medium, Low or Info), the date it was found, and a short advice saying what to do and where. Under Area you narrow the list to one kind of finding:
- People — someone who has not used WrkLst for a long time, someone who signs in with a password alone, an invitation that is still open, or many administrators in one account.
- Sign-ins — a sign-in from a country you do not expect, two sign-ins too close together to travel between, or an address that was refused many times at the API.
- Credentials — API tokens, mobile app devices, address book app passwords and calendar links that have not been used for a long time, that never expire, or that belong to someone who no longer has an active seat.
- AI assistants — a newly connected AI assistant, an assistant that made far more requests than anyone reads by hand, or one that deleted records.
- Public exposure — a presentation link that has been public for a long time or was opened by many visitors, a website webhook that sends data unencrypted, and downloads of the full database backup or the contacts export.
The advice points to the place where you act: deactivate a seat or withdraw an invitation under Settings → User Management, revoke a token under Settings → API Tokens, restore deleted records in the Toolbox, shorten or switch off a presentation link. Some things only the person concerned can do, such as adding a passkey or disconnecting their own AI assistant; the advice then says whom to ask.
If a finding is a risk you take knowingly, choose Accept risk and, if you like, note a Reason, such as who decided and why. An accepted risk no longer lowers the score and is never announced again. Show accepted risks lists them with who accepted them and when, and Count again puts one back.
Reports
Under Reports you find the details behind the findings, in five tabs:
- People — everyone with a seat, their role, their second factor (Passkey, Authenticator app, both, or Password only), their last sign-in and last activity, and the countries they signed in from in the last 30 days.
- Sign-in countries — where your team signed in during the last 30 days, with the number of sign-ins and people per country and whether the country is Expected, Unexpected or High risk.
- Credentials — every API token, mobile app device, address book app password and calendar link, with its access, when it was created, when it expires and when it was last used, and the Connected apps people signed in with their own login. Only the person can disconnect a connected app, in Settings → Connected apps.
- AI assistants — What AI assistants did in the last 30 days, per person: requests, changes, deletions and refusals; Who may connect an AI assistant, role by role, for AI assistants and the REST API; and which of WrkLst's own AI features your team used.
- Public exposure — the Live presentation links with their visitors and visits (your team's own visits are not counted), Data downloads of the last 30 days, and your Website webhooks.
Alerts
Under Alerts you decide whether to hear about new findings without opening the page. It is your own setting; everyone with access decides for themselves.
- Tell me about new findings sends you a notification in WrkLst when the daily check finds something new.
- Also send me an email sends it by email as well.
- Which findings sets the lowest severity you are told about, from Critical only to All findings.
- How often: Daily, on the morning a new finding appears, or Weekly, at most once a week with everything new since the last message.
Expected countries
A sign-in from a country you do not expect is a finding. From your addresses lists the countries WrkLst already expects: those of your headquarters, your other locations and your billing address. Under Also expected, add the countries your team travels to or works from with Add country; they count as expected for everyone. Sign-ins from countries WrkLst considers high risk count as high risk unless you add them here.