Accepted baseline
4 inactive nodes. Header authentication, a fixed tickets.example.test target, and n8n credential references are visible.
JSONSHA-256 b8fec13c99603085cc5bcf158257453b499e41a49f898b373910e606a3e5923e
Open method lab
Workflow Clinic
We review synthetic or permitted public n8n workflows while keeping automated findings separate from human decisions. Customer workflows are not shared here.
Clinic 001 · Handoff boundaries
The accepted baseline goes from an authenticated webhook to a fixed `.test` domain. The synthetic candidate removes authentication, reads a callback target from input, adds a credential-like literal, and gives an AI agent an email tool without a visible approval gate.
2 fingerprinted inputs · 4 synthetic pattern fixtures
Release candidate
5 inactive nodes. Authentication is absent, the target resolves at runtime, a credential-like literal is present, and the AI-controlled email action has no visible approval gate.
JSONSHA-256 1c3ad1461b630290307d7654d833e59af35d363ca50d7ad50c6e420a8ee5b234
Human decision
Automatic records are not verdicts on their own. In this case, the evidence is consolidated into three handoff blockers.
Automated observation
What did the tool flag?
- Credential-like literal value
- Runtime-resolved outbound destination
- Webhook without enforced authentication
- Path from untrusted input to a write-capable AI tool
False-positive record: No false positive was confirmed in this synthetic case. Four automated observations were consolidated into three human blockers without double-counting.
Intake authentication was removedEvidence: The candidate's Public Intake node declares authentication: none.Impact: The entry boundary visible in the baseline is absent from the release candidate.Boundary: The export cannot show whether an upstream gateway adds authentication in production.Correction: Restore a documented authentication boundary and record gateway evidence separately.
A user-controlled target is combined with a credential-like literalEvidence: callbackUrl is read from the body and becomes the Send Callback URL; the same node contains a literal authorization value.Impact: Input can choose the request destination and credential material may travel with it.Boundary: The fixture is never executed and the visible token is inert synthetic text.Correction: Use a domain allow-list, an n8n credential reference, a timeout, and an explicit failure route.
The AI-controlled email action has no approval gateEvidence: Send Client Email is attached to Draft Client Reply as an ai_tool; no approval node is visible on that path.Impact: Untrusted text may steer an external effect without a recorded human decision.Boundary: The export does not prove external policy enforcement or actual SMTP permissions.Correction: Add explicit approval before email and verify production credential scope separately.
Pattern Library
Every pattern has a small, harmless, downloadable fixture.
Unauthenticated webhookA public entry point with no visible native authentication.Evidence: Webhook parameters.authentication is none.Impact: Potential unauthorised calls.Boundary: An upstream gateway is not visible.Correction: Add authentication and failed-attempt limits at the webhook or gateway.Dynamic outbound targetAn HTTP destination is resolved from workflow input.Evidence: The URL expression uses $json.callbackUrl.Impact: A request may be directed to an unexpected host.Boundary: No runtime destination was observed.Correction: Apply an explicit allow-list to the parsed host.Credential-like literal in an exportText resembling a sensitive value is stored in node parameters.Evidence: The Authorization header contains an explicit synthetic token.Impact: A real value could leak through exports and history.Boundary: The fixture value is deliberately invalid.Correction: Revoke the value and use an n8n credential or environment reference.AI action without approvalAn AI agent can use a write-capable tool without visible approval.Evidence: Email Tool is attached to Reply Agent through an ai_tool connection.Impact: Model output or input may directly steer an external effect.Boundary: Runtime permissions and external policy are not visible in the export.Correction: Add human approval before the action and narrow credential scope.
Open method
The same sequence is used for public cases, the free tool, and the paid handoff review.
- 01
Bind the input
Fingerprint baseline and candidate files with SHA-256; never separate file identity from the decision.
- 02
Build the change set
Record node, connection, domain, and credential-type changes without copying values into the report.
- 03
Record automated observations
Write each rule result with evidence and limits; do not present it as a human verdict.
- 04
Make the human decision
Validate delivery impact, mark false positives, and select no more than five blockers.
- 05
Close the scope
Leave unseen production facts, repair work, and the final release owner explicit.
Safe contribution boundary
A customer file is never required for a contribution.
- Synthetic fixture
- Public workflow link with a suitable licence
- False-positive example
- New check proposal
- Source or documentation correction
Do not share customer workflows, secrets, credentials, production payloads, personal data, or private files without permission. Contributions may receive named credit after testing and source review.
Clinic discussion
Suggest a false positive, a new check, or a fixture correction. Discussion uses the existing CSINT membership and moderation system.
Sign in with an email code to comment. Your email address is not shown publicly.