Make blueprint JSON
Make security
A blueprint can carry mapped values and HTTP settings alongside the scenario structure. Review those settings before a handoff, a template release or a production change.
See checks and export stepsAutomation workflow security
Your automation connects everything.
Review what travels with it.
Catch credentials and risky settings in workflow exports before you share a template or hand it to a client. Start with Make, Zapier and n8n.
Check a workflow exportFree · local analysis · no account connection
Zapier workflow JSON
Zapier security
Webhooks and custom fields can put authentication values and request destinations into a Zap export. Review those settings without connecting your Zapier account or running a Zap.
See checks and export stepsn8n workflow JSON · single or array
n8n security
An n8n export can include authentication headers, pinned samples and execution settings. Review the file before you share a template or move it between environments.
See checks and export stepsUseful findings, with context
The checker distinguishes an observed setting, such as disabled TLS verification, from a review candidate, such as a mapped URL or an intentionally public webhook. Each finding explains the next step.
Know what needs a deeper review
An export cannot establish runtime safety, account permissions or how arbitrary code behaves. Reports show recognized HTTP, webhook and code steps alongside coverage limits. More platform adapters can use the same checks as export formats are validated.
Workflow security questions
Does my workflow leave this browser?
The checker reads the JSON in this browser and analyzes it in a local worker. It does not upload the workflow, connect an account, contact its URLs or run its code. The checker route is excluded from VAS analytics and session replay.
Does this replace a full security review?
No. It checks supported exported settings. It cannot verify connection permissions, platform or instance security, upstream gateways, arbitrary code behavior or runtime data flow. No findings is not a security certification.
What is included in the downloaded report?
Fixed finding descriptions, severity, review guidance and numeric workflow/step positions. Names, IDs, input paths, URLs, code, samples and credential values are omitted. Positions follow export traversal order and may differ from canvas numbering.
Is this the same as the VAS platform integrations?
This checker reviews automation exports. The separate VAS integrations retrieve existing website-security reports inside an automation platform. Their availability and setup requirements are described on the integration pages.