I built and released **n8n Workflow Guard**, a small browser-based analyzer for exported n8n workflow JSON.
It focuses on review questions that are easy to miss in a large export: risky data paths, unvalidated input reaching sensitive nodes, credential references, and unclear sub-workflow permission boundaries.
The report is generated locally in the browser. It uses deterministic findings, evidence paths, secret redaction, JSON/SARIF export, sanitized fixtures, input-safety limits, and 16 analyzer tests. It does not connect to a live n8n instance, request API keys, upload workflow data, load remote fonts, or run analytics.
The project is intentionally a review assistant, not an exploit tool or a replacement for n8n’s own security controls. I would value feedback from people who run or review n8n workflows: which exported workflow shapes should be covered next, and where would these rules create false positives?
Repository: GitHub - viktuncoded/n8n-workflow-guard: Privacy-first client-side analyzer for n8n workflow JSON exports with deterministic findings and SARIF reports. · GitHub
Release: Release n8n Workflow Guard v1.0.0 · viktuncoded/n8n-workflow-guard · GitHub
Please use sanitized examples only. I am especially interested in reproducible cases and concrete criticism.