Every time I export a workflow to share here or hand off to a client, I go through the same checklist by hand: did I leave pinData in, is there a token hardcoded in a header, does the webhook path double as a secret URL. I got tired of doing it manually, so I wrote a small script for it.
It reads the exported JSON the way n8n structures it (not just generic regex over the file), and flags:
- pinData — real sample data from your last run
- hardcoded values in
Authorizationheaders,?api_key=query params - known token formats (Telegram, GitHub, Slack, AWS, OpenAI, Stripe, JWT…)
- IBANs (checksum-validated, so it doesn’t just match any 20-digit string)
- webhook
path(it’s effectively a secret URL) - emails, phone numbers, IPs, resource IDs like
chatId/documentId - your own deny-list of client names / internal domains, if you set one
Usage:
python3 scan.py workflow.json python3 scan.py workflow.json --sanitize workflow.public.json
The second command writes a cleaned copy (your original stays untouched) with secrets and IDs replaced, then you re-run the scan on the copy to confirm it’s clean.
Values in the report itself are masked, so the output is safe to paste. No dependencies, standard library only. There’s also an optional git pre-commit hook if you want this enforced automatically before every commit.
To be upfront: it’s heuristic, not a guarantee. “No findings” means known patterns didn’t match — an unusual key format or a client name I didn’t think to list will slip through, so I’d still eyeball node names and Code nodes manually.
Happy to hear what other places secrets tend to hide that I haven’t covered — this started from my own workflows, so it’s probably missing edge cases from other setups.