Scans every workflow on an n8n instance through the public API and scores each one for the ways automations quietly rot: hardcoded secrets, no error workflow, silent failures, missing retries and timeouts, environment-coupled URLs, open write webhooks. Weekly report to Slack, on-demand report in the browser.
How it works
Most automation breaks in ways nobody notices. A lead-qualification pipeline I ran once stopped working for days when an upstream integration renamed a field. The workflow did not error. It just stopped producing. That is the failure this auditor is built to find before it happens.
It pulls every workflow from the instance with cursor pagination, then reads each one's JSON. Every rule looks at fields that already exist: the error workflow setting, retryOnFail on integration nodes, timeout and neverError options on HTTP nodes, authentication on webhooks, and the source of Code nodes for credential-shaped strings.
Each finding carries a weight. A hardcoded secret costs 35 points and is critical. No error workflow costs 20. A silent failure, where non-2xx responses flow downstream as ordinary data, costs 15. Down to 3 for a missing execution timeout. Score is 100 minus the penalties, banded at 80 and 50.
One pipeline, two outputs. A GET on the report webhook renders the full HTML report in a browser. The Monday run and the manual trigger post a summary to Slack and hand the per-workflow scores to the account health workflow, which groups them by client.
Key features
- Nine weighted rules, versioned, so a score can be compared over time
- Secrets are detected by shape (API keys, tokens, inline credential assignments) and masked in the report
- Cursor-paginated fetch with retries and a page cap, so a large instance does not stall it
- HTML report on demand, Slack summary on schedule, JSON handoff to the next workflow
- Reads only existing workflow JSON; nothing is executed to be audited
Step by step
- TriggerMonday 08:00, a manual run, or a GET on the report webhook.
- Fetch All WorkflowsPublic API, 250 per page, follows the cursor up to 20 pages, three retries.
- Audit WorkflowsApplies the nine rules to every non-archived workflow and sorts weakest first.
- Build ReportRenders the HTML page and the Slack text from the same findings.
- Requested As HTML?If the trigger was the webhook, return the HTML. Otherwise post to Slack.
- Hand Off To LifecyclePOSTs the per-workflow scores to the account health workflow.
The nine rules and what they cost
Hardcoded secret, 35, critical. No error workflow, 20, high. Silent failure, 15, high. No retry on an external call, 8. Environment-specific host in a URL, 6. No timeout on HTTP, 5. Unauthenticated write webhook, 5. Undocumented or still on a default name, 4. No execution timeout, 3.
A workflow starts at 100 and loses the weight of every rule it trips. Healthy is 80 and above, at risk is 50 to 79, critical is below 50.