Static analysis of AI automations. Leads on the two checks generic security scanners do not frame: no external action driven by unguarded model output, and every action reachable only through a real human gate. Plus secrets, SSRF, dangerous code, TLS, webhook auth, and resilience.
7workflows scanned
5clean, no failures
3failures to fix
MSP Ticket Triage (before today's fix)
F
13 nodes · 1 fail · 1 warn
severity
check
node
detail & fix
fail
SecretsCWE-798
classify
Anthropic API key hardcoded in headerParameters.parameters[0].valuefix: move the value into an n8n credential and reference it, never inline it in a node parameter
warn
Webhook authCWE-306
Webhook
public webhook has no authenticationfix: add header, basic, or JWT auth to the webhook so the URL alone cannot fire it
MSP Ticket Triage
B
13 nodes · 0 fail · 1 warn
severity
check
node
detail & fix
warn
Webhook authCWE-306
Webhook
public webhook has no authenticationfix: add header, basic, or JWT auth to the webhook so the URL alone cannot fire it
MSP Review & Reputation Engine
B
13 nodes · 0 fail · 1 warn
severity
check
node
detail & fix
warn
Webhook authCWE-306
Review In
public webhook has no authenticationfix: add header, basic, or JWT auth to the webhook so the URL alone cannot fire it
Sim Production Line
B
11 nodes · 0 fail · 1 warn
severity
check
node
detail & fix
warn
Webhook authCWE-306
Webhook
public webhook has no authenticationfix: add header, basic, or JWT auth to the webhook so the URL alone cannot fire it
MSP SEO Content Line
B
11 nodes · 0 fail · 1 warn
severity
check
node
detail & fix
warn
Webhook authCWE-306
Webhook
public webhook has no authenticationfix: add header, basic, or JWT auth to the webhook so the URL alone cannot fire it
Naive agent (anti-pattern)
F
3 nodes · 2 fail · 2 warn
severity
check
node
detail & fix
fail
Human gateCWE-778
email the customer
sends Gmail with no human approval gate on its pathfix: route the action through a Wait node that resumes on a human approval (webhook or form), not a timer
fail
AI guardGK-AI-1 / CWE-807
email the customer
sends Gmail driven by raw model output, no deterministic guard between the model and this nodefix: put a Code or IF node between the model and the action so raw model output is validated before it acts
warn
Webhook authCWE-306
Webhook
public webhook has no authenticationfix: add header, basic, or JWT auth to the webhook so the URL alone cannot fire it
warn
ResilienceCWE-755
agent
external call has no retry and no error routingfix: turn on retryOnFail or route the node's error output so a transient failure does not leak or drop data