Secrets and private data
Token-shaped strings, sensitive fields, emails, IP addresses, credential references, pinned data, and exposed webhook identifiers.
Free n8n production tool
Find the risks hiding in your n8n workflow
Upload an exported n8n workflow JSON. Get a deterministic production-readiness score, prioritized fixes, and an aggressively sanitized copy you can share for review. No account, no AI processing, and the checker does not store your workflow.
Processed in memory
Not stored by checker
No AI processing
2 MB safety limit
01 / Input
Load a workflow export
Export one workflow from n8n as JSON. Do not upload a full instance backup.
Drop your workflow JSON here
The browser reads the file, then sends it over HTTPS for a short in-memory check.
The service does not log or persist request bodies. For maximum caution, rotate any secret that was ever pasted into an untrusted service.
Your report will appear here
The checker follows connections, reviews node settings, and explains each finding without executing the workflow or contacting its services.
Tracing the workflow
Reviewing structure, failure paths, side effects, privacy signals, and AI guardrails.
0
out of 100
Production readiness
0
Critical
0
High
0
Medium
0
Nodes checked
What the checker looks for
Useful findings, not a generic JSON grade
Every rule maps to a concrete production failure, security review, or maintenance decision. The checker shows evidence without echoing detected secrets into the report.
Webhook exposure
Missing authentication, test URLs, delegated responses without a response node, and signature checks that deserve manual verification.
Failure handling
Missing error workflows, HTTP calls without bounded retries, hidden errors, missing execution timeouts, and risky loops.
Duplicate safety
Writes, sends, and creates with no visible idempotency or deduplication signal before an irreversible side effect.
AI guardrails
Free-form AI output without schema validation and model-driven actions without a clearly named human approval step.
Graph integrity
Broken connections, duplicate names, unreachable nodes, standalone scratch nodes, cycles, and workflows that are difficult to own.
Privacy boundary
A share-safe copy should be aggressively boring
The sanitizer removes more than most people expect because a file intended for review does not need production identifiers.
Removed from the downloadable copy
- Credential IDs and names, workflow and version IDs, instance metadata, tags, static data, and pinned execution data.
- Webhook identifiers and paths, absolute URLs, email addresses, phone numbers, IP addresses, and known token formats.
- Values stored under keys such as password, secret, token, authorization, private key, API key, and signing key.
The sanitized copy replaces node names with neutral labels and preserves the connection structure so another person can still understand the graph. Review it manually before sharing.
n8n partner link
Want managed n8n without maintaining a server?
Affiliate disclosure: I may earn a commission if you sign up through this link, at no extra cost to you.