n8n Workflow Checker: Find Pasted Secrets, Open Webhooks and Silent Failures

Paste an exported n8n workflow (or choose the .json file). It is checked in your browser; nothing is uploaded.

What it checks

• Secrets pasted into nodes: API keys, bearer tokens, Slack/Discord webhook URLs, private keys, passwords in URLs, literal auth headers and keys hard-coded in Code nodes. They travel in plain text with every export, Git backup and shared template. Matches are shown redacted.
• Webhooks without authentication, and no error workflow on workflows that run on a schedule, webhook or app trigger.
• Swallowed errors (On Error: Continue) and error outputs that are not connected.
• Pinned test data, orphan and disabled nodes, disabled TLS checks, plain-HTTP calls and HTTP Request nodes without Retry On Fail.

How to get the JSON: in the n8n editor use ⋯ > Download, or select all nodes and copy (Ctrl/Cmd+C) and paste here. For many workflows at once, run n8n export:workflow --all --output=workflows.json and choose that file.

Run it in CI

The same checks are available as a zero-dependency CLI and GitHub Action, so every workflow backup pushed to Git gets audited: n8n-workflow-audit on GitHub (MIT).

npx --yes github:onyxaholguin-cyber/n8n-workflow-audit ./workflows

Fix what it finds

• Set up an n8n error alert workflow
• Back up n8n properly, including the encryption key
• Self-host n8n with Docker Compose and Postgres

Static analysis only; it never connects to your n8n instance. A clean result does not prove a workflow is secure. Built with AI assistance; the rules are covered by automated tests and were run against 99 public n8n.io templates with no false secret errors. Not affiliated with n8n GmbH.