n8n check · secret exposure
Find Hardcoded Secrets in n8n Workflow Exports
Workflow exports are easy to copy, share, back up, and commit. This check looks for secret-like static values and keeps the original value out of Auturance findings.
What is this risk?
A managed n8n credential reference and a literal token embedded in node parameters are different evidence. The export may also contain credentials in HTTP query strings or basic-auth URL components.
A secret-like static signal deserves rotation and storage review, but a detector cannot know from a string alone whether a value is live, synthetic, expired, or protected elsewhere.
Typical failure pattern
A workflow export becomes a credential leak
- API key or token is placed in a node parameter
- Workflow is exported or shared
- The value appears in a repository, ticket, backup, or log
- A copied credential is used outside its intended boundary
Why it matters
- Exports can travel through collaboration, source control, support, and backup systems that were not designed to hold live credentials.
- Query-string secrets are more likely to appear in proxy logs, browser history, and observability systems than credential-managed headers.
Auturance signals
WS001Possible hardcoded secret in node parameters
This is the current scanner signal associated with this check.
WS003Sensitive value may be embedded in an HTTP URL
This is the current scanner signal associated with this check.
What Auturance checks
- Searches node parameters for secret-like names paired with literal values and reports parameter paths only.
- Checks HTTP URLs for credential-like query parameters or embedded basic-auth values.
- Keeps raw secret-like values out of findings, reports, and product analytics.
What Auturance cannot determine
- It cannot determine whether a flagged value is active, valid, or already rotated.
- It cannot validate n8n credential permissions, environment variables, external vaults, or access scope.
- It does not expose original secret values; authorized owners still need to inspect and rotate them safely.
How to reduce the risk
- Move tokens, passwords, and private keys into managed credentials or environment-backed expressions.
- Prefer credential-managed headers over query-string or embedded URL secrets.
- Rotate any credential that may have been included in an export, log, ticket, backup, or repository.
Related checks
Related resource
Review the wider workflow audit boundaries for the broader production-readiness review.
Related guide
See what your workflow reveals
Upload an authorized n8n export and review the static signals in its actual graph.