WorkflowGuard · free and open source
Is your automation leaking credentials?
A free security scanner for n8n, Make, and Zapier workflows. It finds hardcoded API keys, passwords, and authentication gaps in seconds, entirely inside your browser. Nothing is uploaded, nothing is stored, and there is no signup in front of it.
Ten or more credential types detected. One hundred percent browser-based. Zero data sent to any server, including mine.
of companies fail their first PCI DSS audit
Verizon PCI Compliance Reportof HIPAA-covered entities fail to document adequate compliance
HHS-OCR audit report, 2016–2017average cost of a first SOC 2 certification for a fintech company
Industry benchmarkwhat this scanner costs, and what your data costs you to use it
Open source, MIT-style licenseThe hidden compliance risk
Most businesses have no idea their automations are an audit finding waiting to happen.
A workflow gets built under time pressure. A key gets pasted into a code node to make something work. It works, so nobody goes back. Six months later that workflow has been duplicated twice, shared in a forum for help, and exported to a colleague, and the key went with it every time.
Auditors find these. So do people who are not auditors. The difference is what happens next.
Bottom line: this is not a hypothetical. It is the single most common finding I have seen in automation environments, and it is entirely preventable with a scan that takes under a minute.
What your workflows may be carrying
- —Hardcoded AWS keys that expose your entire infrastructure
- —Stripe API keys allowing unauthorized payment processing
- —Unauthenticated webhooks that anyone who knows the URL can trigger
- —Database credentials sitting in plaintext
- —OAuth tokens that never expire
How it works
Drop in your workflow JSON. Get a report in seconds.
Export the workflow from n8n, Make, or Zapier, and load the file into the scanner. Everything after that happens on your own machine.
01
Pattern detection
Scans for ten or more credential types including AWS keys, Stripe tokens, OpenAI keys, GitHub tokens, and generic secrets.
02
Platform-specific checks
Detects n8n unauthenticated webhooks, Make exposed connections, and Zapier plaintext auth, because each platform fails differently.
03
Runs entirely in your browser
Your workflow never leaves your computer. No upload, no server, no tracking. You can verify that yourself in the source, which is the point of publishing it.
04
Security score
A score out of 100 with each finding rated critical, high, or medium, so you know what to fix this afternoon and what can wait.
05
Remediation guidance
Every finding comes with specific instructions for fixing it properly, not just a warning that something is wrong.
06
Downloadable reports
Export results as a text file for documentation, team review, or as evidence in a compliance package.
What it detects
Eight categories, pattern-matched against how these keys are actually shaped
01
AWS access and secret keys
AKIA-prefixed access keys and 40-character secret keys.
02
Stripe API keys
Both live and test keys, sk_live and sk_test.
03
OpenAI API keys
Keys that can quietly run up charges on your account.
04
GitHub tokens
Personal access tokens granting repository access.
05
Slack tokens
Bot, user, and webhook tokens.
06
Generic keys and passwords
Hardcoded credentials in any format the pattern engine recognises.
07
Unauthenticated webhooks
n8n webhooks with no authentication configured at all.
08
Private cryptographic keys
RSA and DSA private keys pasted into workflow code.
Why this exists
I built it after watching companies fail audits over a pasted API key
Sixteen years in digital and computer forensics at the federal level means arriving after something has already gone wrong and reconstructing how. Exposed credentials in a place nobody thought to look is a pattern I have seen more times than any other.
This scanner does the boring version of that work in under a minute, before anyone has to pay for the interesting version. It is free, the source is public, and there is no signup in front of it. That is deliberate, and it is not a funnel.
Credentials
- →CISSP, Certified Information Systems Security Professional
- →CAISP, Certified Artificial Intelligence Security Professional
- →CFE, Certified Fraud Examiner
- →16 years in digital and computer forensics at the federal level
More on the background on the about page.
Questions
Before you run it
Your workflow never leaves your computer. The scanner runs entirely in your browser, with no upload, no server, and no tracking. You do not have to take my word for it: the source is on GitHub and you can read exactly what it does, or run it offline.
n8n, Make, and Zapier workflow exports. Each platform stores credentials differently, so the checks are platform-specific rather than one generic pass.
Yes. It reads the exported workflow JSON, so it does not care whether the instance is cloud or self-hosted. If you can export the workflow, you can scan it.
It is pattern-based, which means it is very good at finding credentials that follow a known shape, and it will not find a secret stored in an unusual custom format. Treat a clean result as "no obvious exposures found," not as a guarantee. A false positive costs you thirty seconds; a missed key can cost considerably more, so the patterns are deliberately tuned to be noisy rather than quiet.
No, and nothing that runs in a browser in under a minute could. It finds one specific class of finding that commonly appears in audits. It is a preflight check, not a certification, and anyone selling you otherwise is selling you something.
Nothing, and there isn't one. No account, no email, no usage limit, and the source is public. If you find it useful and later want help fixing what it found, the AI Operations Assessment is where that conversation goes. If you fix it yourself, that is a perfectly good outcome.
Scan a workflow. It takes under a minute and costs nothing.
If it finds something and you would rather not fix it alone, book a call. If it finds nothing, you have lost a minute and gained a documented check.