Hey everyone,
I built a small free tool for auditing n8n workflows and wanted to share it here.
What it does:
Paste your exported workflow JSON and it instantly checks for:
Hardcoded secrets (API keys, passwords in node parameters)
Orphan nodes (nodes not connected to anything)
Missing error handling
Overly complex flows that should be broken into sub-workflows
Why I built it:
I kept seeing (and making) the mistake of leaving credentials hardcoded in workflow parameters. Wanted a quick sanity check before sharing or deploying workflows.
Privacy: Everything runs 100% in your browser. Your workflow JSON never leaves your machine.
It’s free, no login required:
Would love feedback — especially from power users who have more edge cases than I do. What other checks would be useful?
2 Likes
Hello,
For starters I want to say this a very cool idea. Alot of use dont think about the bullet points you have implemented inside of the FlowGuard. These are direct issues that can cause small hiccups later even when deploying a workflow. Myself also makes the same mistakes in doing so leaveing credentials hardcoded in my workflows as well.
Hi,
Thank you for the feedback!
I would love to know if you have any additional thoughts or specific features you would find useful. I plan to add those in and will keep everyone updated here.
Hello,
Nothing to add as of know, I’m starting my learning journey today. I have been implementing with n8n. Through research, and watching others. I’m fast vivid learner, but I want to expand my horizons and knowledge base. I’m a software developer that believes in critical logs, and incident reporting. Do you have any automated agents attached to this?
Three checks I’d add, roughly in order of how often they actually bite:
- Webhook nodes with no authentication configured — the most common way a workflow quietly becomes a public API.
- HTTP Request nodes with no retry and no timeout override. Those are the ones that fail at 3am and leave no trace.
- Workflows with no error workflow set in Settings. That’s a different miss from “has no error-handling nodes” and much easier to overlook, because the canvas looks fine.
The one I’d most want a scanner for: expressions that drop user-controlled input straight into a SQL query or an LLM prompt. Injection surface is easy to forget exists when the tool is visual.
Hi colemaffeo6,
I am working on these features right now.
Do you think this is something that can be turned into a proper product that people might find useful and pay for? If so, what are some polishes, integration approaches, and features you think would make it worth paying for, and how much would you price it at?