Security Findings

All security issues discovered during the N8N workflow audit of OVH2 (15.204.10.51), ranked by severity.

Critical — Exposed API Keys

These API keys are hardcoded directly in workflow JSON files and should be rotated immediately.

1. OpenAI API Key

The key is embedded directly in the workflow JSON rather than stored in the N8N credential store. Since this workflow is active, the key is in active use.

2. Mistral API Key

Also found in Telegram chatbot workflows on the same instance.

3. Replicate API Key

Hardcoded in 4+ HTTP Request nodes as Bearer token headers.

4. Creatomate API Key

Hardcoded in 2+ HTTP Request nodes as Bearer token headers.

High — Hardcoded Service Credentials

5. Z-API WhatsApp Credentials

The Z-API credentials are embedded directly in HTTP request URLs rather than stored in N8N credential store. Example URL pattern:

https://api.z-api.io/instances/3D21D6F.../token/743FD59.../send-text

Three of these workflows are ACTIVE, meaning the credentials are in production use.

6. Hardcoded Phone Numbers

These are embedded in workflow JSON and visible to anyone with access to the N8N instance or exported workflow files.

Medium — Configuration Issues

7. Webhook Path Conflicts

Path: /api/v1/voice-chat — used by 5 workflows:

Only one workflow can handle requests at a given webhook path. Having two active workflows on the same path means one is silently shadowing the other.

Path: /webhook/91ce8cb8-... — used by 2 ACTIVE workflows:

8. SQL Injection Risk

The CMS workflow builds SQL queries using template literals with user-provided values, e.g.:

SELECT * FROM table WHERE id = '${input.value}'

Low Severity

9. Supabase Project URLs Exposed

The Supabase project URL kagtryxgjwavupzlmlzv.supabase.co is hardcoded in:

• stateless hypno elp (active) — /functions/v1/update_ai_usage
• Gmail AI Auto-Responder (active) — /functions/v1/app_logs

10. Aggressive RSS Polling

The Youtube Transcription Analyzer (bB8J4YpysaGg9xaT) has an RSS trigger set to poll every minute. While inactive, if activated it would generate excessive requests.

11. Active + Archived Inconsistency

Four workflows are marked both active: true and archived: true, which is an inconsistent state:

• Life on Roatan (xS7dskXPJcOvT0zz)
• maxtracks AI (7i6iPUkkRl7dLSUo)
• Google Maps Email Scraper (SeYAtAj3TnQZDb70)
• My Sub-Workflow 1 (r90VSqrWWb9giFEi)

Recommendations

Immediate Actions

1. Rotate all exposed API keys — OpenAI, Mistral, Replicate, Creatomate
2. Move Z-API credentials to N8N credential store instead of hardcoding in URLs
3. Remove phone numbers from workflow JSON files
4. Fix webhook path conflicts — deactivate duplicate registrations

Short-Term

5. Use parameterized queries in the CMS workflow to prevent SQL injection
6. Clean up archived workflows — resolve active+archived inconsistencies
7. Audit n8n-dev2 — 4 unused workflows, consider decommissioning the instance
8. Review Firebase endpoints — max-inventory-scanner-b0b53 Cloud Functions are called without authentication

Long-Term

9. Implement workflow naming conventions — many workflows are “My workflow N”
10. Consolidate MCP servers — multiple overlapping MCP server workflows
11. Document credential ownership — track which team member owns each credential
12. Set up credential rotation schedule — especially for API keys