DE EN IT

~/home / n8n-workflow-xray

n8n · X-Ray

An X-ray for your n8n workflow.

Export a workflow, paste the JSON and see what could go wrong in the worst case: which nodes spend money, send mail, delete data or run commands, and whether a safeguard stands in front of them. As a map, with a grade and concrete fixes.

Paste a workflow

Load an example:

In n8n: open the workflow, Ctrl+A, Ctrl+C, paste here. 512 KB and 400 nodes at most.

🔒 Privacy: your workflow is neither stored nor logged. No cookies, no IP address in the report. The report is kept for 7 days and can be deleted at any time. Privacy policy

Delete this report?

The report will be deleted for good and links to it will stop working. Your workflow was never stored.

⚠ Not a security certificate: «nothing found» does not mean «safe». X-Ray only checks the rules listed below, deterministically and without any guarantee.

How does it work?

  1. Paste the JSONYou export the workflow in n8n and paste it here. It is only passed through and never stored.
  2. Apply the rulesAn n8n workflow with a code node checks fixed rules. No AI decides what is risky.
  3. Measure the blast radiusFor every dangerous node the path from the trigger is followed: is there an approval, a condition or a limit in front of it?
  4. Map and gradeYou get a grade A to F, a map like an X-ray, and for every finding the why and the fix. An AI at most orders the priorities, from node names and rules only.

Which rules does X-Ray check?

The rules are fixed and the same for every workflow. Each has a stable number.

  • R01
    Webhook without authentication

    Anyone who knows the address can trigger the workflow.

  • R02
    Secret in plain text

    Passwords, API keys or tokens sit directly in the parameters instead of n8n credentials. In the report they only show up as «redacted».

  • R03
    Dangerous action without a guard

    From a trigger or AI agent you can reach a payment, mail, deletion or shell without an approval, condition or limit in front (the «3 a.m. rule»).

  • R04
    AI agent with dangerous tools

    An agent may trigger money, mail or deletion with no iteration limit and no human approval.

  • R05
    No error workflow

    There is neither an error workflow nor an Error Trigger: failures go unnoticed.

  • R06
    HTTP call without retry

    Neither retry nor «continue on error» is set.

  • R07
    Duplicate runs possible

    A webhook leads to a payment or a write without any duplicate check.

  • R08
    Real test data in the export

    The export contains pinned data (pinData), maybe with personal details. X-Ray does not read it, it only warns.

  • R09
    Loop without a brake

    A loop calls HTTP endpoints without a Wait node or small batches.

  • R10
    Housekeeping

    Disabled or orphan nodes, default names like «HTTP Request1», no notes, no execution timeout.

  • R11
    Code with eval or child process

    A code node uses eval, Function or child_process and can run arbitrary code.

What counts as dangerous, what as a guard?

Dangerous are nodes that trigger payments, send mail or messages, delete data or write to databases, run commands or write to the outside world.

Guards are Wait with approval, «send and wait» (human in the loop), IF, Switch and Filter with a condition, limits in loops and a check right after the webhook.

What X-Ray does NOT check

  • Whether the credentials stored in n8n themselves have too many rights.
  • Whether prompts are open to prompt injection or whether the business logic is right.
  • The server, the n8n version, the network and updates.
  • Called sub-workflows: only the pasted workflow is checked.
  • Unknown community nodes: they are classified by name and type only.

Frequently asked questions

What is a blast radius in n8n?

The blast radius is the possible damage when a workflow runs wrongly or is abused: which payments, mails, deletions or commands can be triggered, and whether a safeguard such as an approval or a condition stands in front.

Is my workflow stored?

No. The pasted workflow is only analysed and neither stored nor logged. The report holds shortened node names, types and findings, and secrets found are redacted. It is deleted after 7 days, and you can delete it yourself before that.

Does an AI decide what is risky?

No. The rules are fixed and run deterministically in a code node. An AI at most writes two or three lines about the priorities, and only from node names and rules, never from parameter values.

Does grade A mean my workflow is safe?

No. X-Ray is not a security certificate. «Nothing found» only means these rules reported nothing. The list of what is not checked is at the top of this page.

Can I run X-Ray myself?

Yes. The workflow is available as a JSON download and can be imported into any n8n instance.

Related tools

← Home