Tell me what you have, or pick a starter below. I will point you to the right CSINT page and the next safe step.
ServicesAI automation security review
Review n8n and AI agent workflows before they reach production.
The exported workflow JSON is scanned locally. Embedded secrets, uncontrolled tool use, unvalidated model output, and missing failure paths are recorded in a direct report.
What is checked?
- Tokens and credentials accidentally embedded in the workflow
- Webhook entry points without authentication
- Untrusted input reaching a model without visible validation
- Model output causing external actions without approval
- Missing schema checks, rate limits, timeouts, and error routes
- Dynamic URLs and possible SSRF exposure
What you receive
- A short, prioritised finding list
- The affected n8n node and evidence for each finding
- Remediation guidance and a retest note
- OWASP LLM and NIST AI RMF references
- A shareable Markdown or PDF report
What was found in an unsafe workflow?
An intentionally unsafe support agent was scanned locally. Nine issues were found without uploading the file.
Security score
10/100
- Total
- 9
- High
- 4
- Medium
- 4
- Low
- 1
Three findings from the scan
High
Untrusted webhook input reaches the model directly.
Affected node: Public Support Webhook -> Customer Support Agent
Fix: Add size, type, and allowlist checks before the model.
High
Model output can send email without human approval.
Affected node: Customer Support Agent -> Send Account Email
Fix: Require human approval before any email is sent.
Medium
The public webhook does not require authentication.
Affected node: Public Support Webhook
Fix: Enforce header or JWT authentication at the webhook.
Evidence you can download
The scan runs on your machine and the file is never uploaded. The results in this section are the actual output of the scan shown in the video.
Sample report
An intentionally unsafe support agent scored 10/100, with four high, four medium, and one low finding. The same scanner scored a real CSINT classification workflow at 91/100 and identified only audit logging and error-route gaps.
- Unsafe
- 10
- CSINT
- 91
Your file stays local
The scanner runs locally and does not call an LLM service. I do not need customer data, passwords, API keys, or production access. Remove secrets from the workflow before sharing it anyway.
Who is it for?
Built for n8n agencies, small teams, and operations teams running AI agents in production. It is most useful when a workflow can act on webhooks, email, CRM, support systems, or external APIs.
Pilot review
EUR 99 for the first three reviews
One workflow with up to 40 active nodes, the automated scan, a manual review of the five most important paths, a short handoff call, and one retest are included. Delivery is within three business days.
This is a defensive static configuration review. It is not a penetration test, compliance certification, or security guarantee.