n8n-security-testing

Credential detection in n8n scans workflow JSON exports and runtime executions for exposed API keys, tokens, and secrets. The Skill applies pattern-based detection across integration nodes to identify unencrypted credentials before they're transmitted or logged, reducing breach risk.

OAuth flow validation checks secure token storage, encryption-at-rest for credentials, and proper token rotation mechanisms in n8n integrations. It verifies that OAuth tokens are encrypted and handled securely throughout the workflow lifecycle, not exposed in logs or exports.

Encryption verification validates that sensitive data is encrypted at rest in your n8n configuration and in transit across webhook and integration nodes. The Skill audits encryption-at-rest status and checks input sanitization to ensure data transmission is secure.

Yes. The Skill scans workflow JSON exports, runtime execution logs, and integration node outputs for exposed credentials. It identifies credentials that may have been logged unsafely and validates audit logging captures secure credential handling without exposing secrets.

Pattern-based credential detection depends on recognizable formats and encoding; obfuscated or custom credential formats may not be caught. The Skill requires access to workflow exports and execution logs; real-time detection during workflow execution may have coverage gaps depending on n8n runtime configuration.

Security testing applies to n8n workflow JSON exports and standard integration nodes. No specific version dependency is required; the Skill validates credential handling and encryption across common n8n setups, though custom nodes or legacy versions may require manual review.