N8N Audit Overview

Date: 2026-03-03 Server: OVH2 (15.204.10.51) Repo: OmelasAI/n8n-audit (private)

Scope

Full audit of all N8N workflow automation instances running on the OVH2 development server. The audit covers:

• 4 N8N instances running in Docker containers
• 99 workflows (JSON exports of every workflow)
• ~120 credentials referenced across all workflows
• Security analysis of hardcoded secrets, API keys, and exposed credentials

Methodology

1. SSH access to OVH2 via ssh ovh2 (user ubuntu, key ~/.ssh/ovh2_dev)
2. Docker exec into each N8N container to export workflows via CLI:

   docker exec <container> n8n export:workflow --all --separate --output=/tmp/export/
   

3. Credential metadata exported (names/types/IDs only, not secrets):

   docker exec <container> n8n export:credentials --all
   

4. JSON analysis of all 99 workflow files for hardcoded secrets, API keys, URLs, and operational flows
5. Per-instance documentation with operational descriptions of every workflow

Instance Summary

Infrastructure

All 4 instances run on the same Docker host with a shared Caddy reverse proxy and PostgreSQL database.

Key Findings

Critical Security Issues (4)

• Exposed OpenAI API key in stateless-hypno-elp workflow JSON
• Exposed Mistral API key in Hypno-elp copy workflow JSON
• Exposed Replicate API key in AI Faceless Video Bearer headers
• Exposed Creatomate API key in AI Faceless Video Bearer headers

High Severity (2)

• Z-API credentials hardcoded — instance ID, token, and client-token embedded in URLs across 5+ workflows instead of using the N8N credential store
• Phone numbers in workflow JSON — real phone numbers embedded in workflow configurations

Medium Severity (2)

• Webhook path conflicts — 5 workflows share /api/v1/voice-chat path; 2 active workflows share another webhook path
• SQL injection risk — CMS workflow on n8n instance builds queries with string interpolation

Workflow Categories

GitHub Repository Structure

OmelasAI/n8n-audit/
+-- README.md              # Master overview
+-- max/
|   +-- README.md          # 25 workflows documented
|   +-- workflows/         # 25 JSON files
+-- n8n/
|   +-- README.md          # 9 workflows documented
|   +-- workflows/         # 9 JSON files
+-- n8n-dev1/
|   +-- README.md          # 61 workflows documented (1,688 lines)
|   +-- workflows/         # 61 JSON files
+-- n8n-dev2/
    +-- README.md          # 4 workflows documented
    +-- workflows/         # 4 JSON files

External Services Referenced

The workflows collectively connect to these external services: