n8n Workflow: Scan Git & CI Logs for Secret Leaks + WhatsApp Alerts

Automatically find secret leaks in Git & CI logs—and alert the right people on WhatsApp

This n8n workflow scans your GitHub commits and CI/CD pipeline logs for leaked credentials, verifies suspicious findings against GitHub and Stripe when possible, and sends WhatsApp alerts with a remediation checklist—then re-verifies after confirmation to confirm whether the secret is still active.

What this workflow does

• Runs on schedule (every 6 hours) or on-demand via a manual trigger.
• Collects evidence: fetches the latest commit list from your configured GitHub repository, then pulls CI/CD logs from your configured CI API endpoint.
• Detects secrets: scans log and commit text for common secret patterns (e.g., AWS keys, GitHub tokens, Stripe keys, and high-entropy strings), masks matches, and deduplicates findings.
• Routes findings by category: suspected credentials are verified via provider API calls (GitHub /user and Stripe /v1/account where applicable); high-entropy matches that can’t be validated are marked for manual review.
• Scores risk & severity: generates a risk score using secret type, source (repo vs CI), confidence, and whether the credential appears still valid.
• WhatsApp notification + remediation loop: sends WhatsApp alerts based on severity. For critical/high findings, it waits for an external remediation confirmation webhook, pauses for a grace period, then re-verifies and sends a resolution or escalation message.

Use cases

• Proactively detect accidental token exposure in GitHub commits and CI logs.
• Reduce time-to-response by sending incident-ready WhatsApp alerts with concrete remediation steps.
• Verify whether leaked credentials (GitHub/Stripe) remain valid after teams claim they’ve rotated them.

Technical details

• n8n nodes / building blocks: if, set, code, wait, switch, WhatsApp
• Integrations: GitHub (commit retrieval + API verification via /user), CI/CD log API endpoint, Stripe verification via /v1/account
• Core logic: secret pattern scanning, masking, deduplication, risk scoring, WhatsApp messaging, confirmation webhook, wait/grace period, and re-verification.