n8n's credential store itself is fine to hand out. n8n's own documentation describes separate commands for exporting workflows versus exporting credentials, and a workflow JSON only carries a credential's name and internal ID, not the key behind it. What actually leaks when someone shares a workflow file almost never comes from that store. It comes from the stuff nobody thinks to call a credential.
This comes up more than people expect. A stuck workflow gets exported and pasted into a Discord thread, a Reddit post, a GitHub gist for a freelancer to look at, an email to an agency doing a handoff audit. Every one of those is a JSON file leaving your control, and most people check it for nothing more than whether it's the right workflow.
Three places secrets actually hide
A r/n8n thread this week made the case well: someone built a script that scans exported workflows for exactly this before posting them, checking for Telegram bot tokens, API keys, IBANs, and pinned data. Here's where each of those actually shows up in the file.
Values typed straight into a node
The Credential type exists so a key never touches the workflow JSON. It's easy to skip when you're moving fast — paste a token into an HTTP Request node's header field to get something working, mean to swap it for a real credential later, forget. That value sits in plain text inside the node's parameters, and it exports with everything else.
Pinned data that captured something real
Pinning freezes a node's last output so you can build the rest of the workflow without re-triggering it every time. Handy while you're building. The catch: whatever ran through that node when you pinned it — a real customer's chat ID, an actual API response with a token sitting in the body, a live IBAN from a payments test — comes along for the ride. It's not a hypothetical. It's whatever real data happened to be flowing through your system the moment you clicked pin, frozen into the file forever. Clearing pinned data before export is a five-second click almost nobody remembers to make.
A webhook with nothing checking who calls it
n8n's Webhook node ships with four authentication options: Basic, Header, JWT, or None. The path itself is a randomly generated string by default, which n8n's docs say exists "to avoid conflicts with other webhook nodes" — not to keep it secret. There's also an IP allowlist field you can layer on top, but it's off unless you turn it on. If Authentication is set to None and no allowlist is set, that random-looking path is the only thing standing between a stranger and your trigger. Hand out the export, and you've handed out the trigger with it.
A credential you store properly survives an export. One you typed into a text field doesn't know the difference.
What to check before you paste it anywhere
- Search the JSON for "Authorization," "Bearer," "token," or any long, random-looking string before you post it.
- Open every node that shows a pin icon and clear it, or re-run the workflow against test data first.
- Move any header or body value that looks like a secret into an actual n8n credential — it's the same number of clicks, and it's the one that doesn't leak.
- Check every Webhook node's Authentication field. If it says None and you're sharing the export, either turn one on or treat that file as a live trigger, not a debugging aid.
- If you've already shared a workflow with a real token in it, don't just edit the file — rotate the key at the source. A deleted Reddit comment doesn't unsee a copied file.
This is the first pass on any build we inherit
Half of taking over someone else's n8n build is exactly this — reading what's actually in the workflow before touching anything, not what whoever built it assumed was safe. A header field with a key typed in six months ago rarely gets noticed until someone new is looking at the JSON for the first time. If you're handing an agency or a freelancer access to an existing automation, ask them to do the same before anything changes. It's a standard part of the automation work we take on, and if you want a second set of eyes on a workflow before you hand it to anyone, get in touch.
— Cole
Sources
- r/n8n: a script that scans workflow exports for leaked secrets — the discussion that prompted this post
- n8n Webhook node documentation — default path behavior and authentication options
- n8n workflow export and import documentation — separate export paths for workflows vs. credentials