Our account received HubSpot’s Node.js custom-code vulnerability notice, but after downgrading we cannot access Workflows to follow the security instructions.
Please escalate this to Support/Security. We need all existing workflows disabled without deleting workflows or CRM data, and confirmation that custom-code actions cannot execute.
We have already rotated and immediately expired all six private-app access tokens. Please provide a private channel for our account ID and further investigation.
Could a HubSpot Community moderator help arrange a private escalation to Support/Security? Since the downgrade prevents access to Workflows, this needs an account-specific review.
Rotating the private app tokens was the right first move. One more thing to check: if any custom code actions used secrets for other services (a Stripe key, a Slack webhook, your own API), rotate those at the source too, since turning the workflows off doesn’t make a leaked key safe.
On the workflows themselves, I think custom code can’t run once the account no longer has Operations Hub Pro, but I wouldn’t lean on my guess for a security issue. The notice email should have a reply path or case reference, which will get you a private channel faster than this thread