Zapier workflow security · local export checker

Review the security settings inside your Zaps.

Webhooks and custom fields can put authentication values and request destinations into a Zap export. Review those settings without connecting your Zapier account or running a Zap.

Check a Zapier export

Free · no signup · JSON stays on your device

1. Choose your export

Zapier workflow JSON

2. Review supported checks

Static analysis in a local browser worker

3. Apply the fixes

Download a report without secret values

What the Zapier checker looks for

Hardcoded credentials in step parameters

Checks literal credential-like fields, named headers, Webhooks Basic Auth and recognizable secret formats. Saved connection references are not themselves secrets.

Outbound Webhooks requests

Reviews supported Webhooks steps for unencrypted URLs and credential-like URL parameters. Catch Hook triggers are not treated as outbound requests.

Custom code coverage

Counts recognized Code steps so you can see what still needs manual review. It never runs JavaScript or Python from the export.

Export from Zapier

  1. In Zapier, open Settings → Security and data.
  2. Request Download my account data, or use the workflow export option available to your account. Zapier emails the download when it is ready.
  3. If the download is a ZIP, extract only zapfile.json and select that JSON in the checker. Do not upload task-history links or app-connection exports.
Zapier account export guide

Before you check an export

Does my workflow leave this browser?

The checker reads the JSON in this browser and analyzes it in a local worker. It does not upload the workflow, connect an account, contact its URLs or run its code. The checker route is excluded from VAS analytics and session replay.

Does this replace a full security review?

No. It checks supported exported settings. It cannot verify connection permissions, platform or instance security, upstream gateways, arbitrary code behavior or runtime data flow. No findings is not a security certification.

What is included in the downloaded report?

Fixed finding descriptions, severity, review guidance and numeric workflow/step positions. Names, IDs, input paths, URLs, code, samples and credential values are omitted. Positions follow export traversal order and may differ from canvas numbering.

Is this the same as the VAS platform integrations?

This checker reviews automation exports. The separate VAS integrations retrieve existing website-security reports inside an automation platform. Their availability and setup requirements are described on the integration pages.

Independently developed by Silex Dev. Platform names describe compatible export formats; they do not imply endorsement of this checker.