n8n Workflow Guard v1.0.0

n8n Workflow Guard v1.0.0

The first official public release of a privacy-first, client-side analyzer for n8n workflow JSON exports.

Highlights

• Parses workflow JSON locally in the browser. No upload queue, live n8n-instance access, API keys, remote fonts, or analytics.
• Detects hardcoded credential-like values, credential references inside inline sub-workflows, external-trigger paths crossing sub-workflow boundaries, and unvalidated input reaching sensitive sinks.
• Produces a human-readable report with severity, evidence paths, affected nodes, and recommended actions.
• Exports JSON for review and SARIF for GitHub Code Scanning workflows.
• Includes input-size, JSON-depth, and node-count safeguards, plus cycle detection, malformed graph diagnostics, duplicate-name findings, dangling-edge checks, and secret redaction in evidence.
• Ships with sanitized example workflows and 16 deterministic analyzer tests.

Validation

• pnpm check passed
• pnpm test passed — 16 tests
• pnpm build passed
• GitHub Actions quality run passed on commit 0b28430

Scope and limitations

Workflow Guard is a review assistant, not an exploit tool and not a replacement for n8n security controls. Node coverage and export shapes can vary between n8n versions, so findings should be verified in the n8n editor and in the surrounding permission model. Live-instance scanning is intentionally out of scope for this release.

Next steps

Planned follow-up work includes richer sub-workflow extraction, explicit data-flow labels, a shared CLI package, and a GitHub Action that can fail a pull request when critical findings are introduced.

MIT licensed. Independent community project; not affiliated with n8n GmbH.