The problem in one sentence
GoHighLevel snapshots can ship workflows in Published status. A published workflow runs even if you never built or reviewed it. If you later import contacts into that sub-account, those contacts can enter that flow and receive its emails.
How we found it
While auditing a sub-account built from a snapshot, we saw a workflow called "Long-Term Follow-Up" that was published, had no trigger, and had "Wait 7 days" as its first step. Inside it were the 179 contacts that had been imported weeks earlier.
Over three weeks it sent four generic real estate investing emails to about 174 of those contacts, signed with the client's name. The result: 17 bounces, 8 unsubscribes, zero replies and no postal address in the email footer. Nobody noticed until the audit.
Another workflow from the same snapshot fired on the condition "Tag added includes 'a'" and carried a teeth-whitening offer from a snapshot built for a different niche.
A screenshot had made everything look safe: it showed several workflows in Draft with zero enrolled. But six of fourteen were published.
Before importing contacts: the 10-minute audit
- List every workflow in the sub-account and filter by status. Trust the real status of each one, not an old screenshot.
- Switch to Draft every published workflow that you did not build and review yourself. You do it in the builder with the Draft/Publish toggle, and it saves on its own.
- Check for odd triggers: workflows with no trigger, tag conditions that are too broad ("includes 'a'") or empty filters.
- In the import wizard, leave the option to add to a workflow empty. Import first and assign later, on purpose.
- Review custom values and offer text. A snapshot from another niche brings its own offer, its own phone number and its own signature.
The public HighLevel API lets you read a workflow's status but not change it. Turning them off is done by hand in the builder.
If it already happened
- Switch the offending workflows to Draft right now, before you measure the damage.
- Count bounces and unsubscribes in Conversations. The enrollment history only keeps about 60 days, so audit soon.
- Tell the client, with the real numbers and what you changed.
- Check that your commercial emails carry a physical postal address in the footer. The US CAN-SPAM law requires it.
The rule that stays
Treat a published workflow from a snapshot as someone else's code in production, not as a template. Review it before it touches a real contact.