I'd check scripts/workflows as the most likely offenders.