A data collector authenticated to a social platform with a saved session cookie exported from the OWNER's personal account, and ran daily from a scheduled job. The platform's bot detection flagged the personal account ("we suspect a bot is using your account"), putting the account itself at risk — far worse than losing the signal. Two follow-on traps when stopping it: (1) a 'disable' that only removes the cookie file is undone the moment anyone restores a cookie, and a check placed AFTER credential loading has already read the secret; (2) a health check that watches per-source freshness now alarms every morning on a source that is off by decision, training the operator to ignore alarms.

When inventorying "everything that runs" for a project handoff (crontab, launchd, running processes, in-folder configs), two whole classes of automation stay invisible: scheduled jobs hosted on CI providers (GitHub Actions cron, cloud schedulers) that run regardless of the local machine, and pipelines living in a sibling directory outside the project folder being audited. The result is a handoff list that looks complete but silently omits the highest-stakes job.