HTTP authentication and transport
Checks embedded credentials, including JSON headers, query parameters and bodies, plain HTTP destinations and explicit certificate-verification bypasses. Credential names and IDs are not flagged as secrets.
n8n workflow security · local export checker
Find security gaps in your n8n workflow export.
An n8n export can include authentication headers, pinned samples and execution settings. Review the file before you share a template or move it between environments.
Check a n8n exportFree · no signup · JSON stays on your device
1. Choose your export
n8n workflow JSON · single or array
2. Review supported checks
Static analysis in a local browser worker
3. Apply the fixes
Download a report without secret values
What the n8n checker looks for
Webhook authentication settings
Marks Webhook nodes without built-in authentication for review. A gateway or signature-checking step may still protect an intentional public webhook.
Data left in the export
Highlights pinned-data presence and explicit successful/manual execution-data saving. It does not display the samples or infer instance-wide retention defaults.
Export from n8n
- Open your workflow in the n8n editor.
- Open the workflow menu and choose Export JSON (or Download in some versions).
- Select the JSON file in the checker. Do not export decrypted credential files; the checker does not need them.
Before you check an export
Does my workflow leave this browser?
The checker reads the JSON in this browser and analyzes it in a local worker. It does not upload the workflow, connect an account, contact its URLs or run its code. The checker route is excluded from VAS analytics and session replay.
Does this replace a full security review?
No. It checks supported exported settings. It cannot verify connection permissions, platform or instance security, upstream gateways, arbitrary code behavior or runtime data flow. No findings is not a security certification.
What is included in the downloaded report?
Fixed finding descriptions, severity, review guidance and numeric workflow/step positions. Names, IDs, input paths, URLs, code, samples and credential values are omitted. Positions follow export traversal order and may differ from canvas numbering.
Is this the same as the VAS platform integrations?
This checker reviews automation exports. The separate VAS integrations retrieve existing website-security reports inside an automation platform. Their availability and setup requirements are described on the integration pages.
Independently developed by Silex Dev. Platform names describe compatible export formats; they do not imply endorsement of this checker.