n8n Security Drift Scanner: SMTP Email New Findings

n8n Security Drift Scanner: SMTP Email New Findings

Catch risky changes in your n8n automation before they become incidents. This workflow performs a weekly, read-only security audit of every active workflow on your instance, detects new security issues and configuration drift, and emails only the findings that are new since the last run via SMTP.

What this workflow does

• Runs every Monday at 07:30 using a schedule trigger, then loads all workflows through the n8n API (archived workflows are skipped).
• Uses a Code node to scan each workflow for hardcoded secrets, including inactive ones (because templates can be cloned and exported).
• For active workflows, checks for:
  • Unauthenticated webhooks
  • Broken or missing error handling workflows
  • Webhook authentication headers present in the execution log
  • Active test or temp workflows
• Compares execution-data protection and MCP access against the strictest previously observed value, so a lowered setting is reported instead of becoming the new normal.
• Sends an email containing only new findings since the previous run. The baseline is saved after the email is sent, preventing lost results if sending fails.

Use cases

• SaaS operators who want automated, recurring n8n security hygiene across many teams and workflows.
• Automation engineers who need early warnings when secrets, webhook exposure, or error handling are accidentally changed.
• Teams managing workflow templates who want protection against exported/cloned workflows carrying hidden risks.

Technical details

• Integrations/credentials: n8n API key (for “Fetch All Workflows”) and SMTP credentials (for “Dispatch Alert Email”).
• Nodes used: if, n8n (API fetch), set, code, email send, and sticky note.

Setup highlights

Create an n8n API key in Settings > n8n API, add it as a credential for Fetch All Workflows, configure SMTP credentials for email delivery, set notifyTo and notifyFrom, and run once manually to build the initial baseline (the first scheduled run reports all findings once in production).