# Block a deploy on critical n8n workflow findings

**Use case:** 

Run the same deterministic rule engine as a pre-merge or pre-deploy gate and get back only the findings that should stop a release: hardcoded credentials, expression sandbox escapes, unauthenticated webhooks, SQL injection and deprecated nodes. No LLM is involved anywhere in the audit, so the same workflow JSON produces the same findings every run and a build that passes today passes tomorrow.

## Input

```json
{
  "workflowJson": {
    "name": "Deploy notifier",
    "nodes": [
      {
        "id": "1",
        "name": "Deploy webhook",
        "type": "n8n-nodes-base.webhook",
        "typeVersion": 2,
        "position": [
          0,
          0
        ],
        "parameters": {
          "path": "deploy",
          "httpMethod": "POST"
        }
      },
      {
        "id": "2",
        "name": "Read release notes",
        "type": "n8n-nodes-base.httpRequest",
        "typeVersion": 4.2,
        "position": [
          240,
          0
        ],
        "parameters": {
          "url": "https://api.github.com/repos/acme/api/releases/latest",
          "sendHeaders": true,
          "headerParameters": {
            "parameters": [
              {
                "name": "Authorization",
                "value": "Bearer ghp_9dKp2Vn7RtLqZxYbWcHf3TgJm4QsEuIo0PzX"
              }
            ]
          },
          "options": {
            "timeout": 10000
          }
        }
      },
      {
        "id": "3",
        "name": "Resolve channel",
        "type": "n8n-nodes-base.set",
        "typeVersion": 3.4,
        "position": [
          480,
          0
        ],
        "parameters": {
          "assignments": {
            "assignments": [
              {
                "id": "a",
                "name": "channel",
                "type": "string",
                "value": "={{ require('os').hostname() }}"
              }
            ]
          }
        }
      },
      {
        "id": "4",
        "name": "Announce",
        "type": "n8n-nodes-base.slack",
        "typeVersion": 2.2,
        "position": [
          720,
          0
        ],
        "parameters": {
          "channel": "={{ $json.channel }}",
          "text": "Deployed"
        },
        "credentials": {
          "slackApi": {
            "id": "4",
            "name": "Slack account"
          }
        }
      }
    ],
    "connections": {
      "Deploy webhook": {
        "main": [
          [
            {
              "node": "Read release notes",
              "type": "main",
              "index": 0
            }
          ]
        ]
      },
      "Read release notes": {
        "main": [
          [
            {
              "node": "Resolve channel",
              "type": "main",
              "index": 0
            }
          ]
        ]
      },
      "Resolve channel": {
        "main": [
          [
            {
              "node": "Announce",
              "type": "main",
              "index": 0
            }
          ]
        ]
      }
    },
    "settings": {}
  },
  "workflowUrls": [],
  "workflowIds": [],
  "activeOnly": false,
  "ruleSet": "all",
  "minSeverity": "high",
  "ignoreRules": [],
  "includeReport": false
}
```

## Output

```json
{
  "severity": {
    "label": "Severity",
    "format": "string"
  },
  "rule": {
    "label": "Rule ID",
    "format": "string"
  },
  "ruleTitle": {
    "label": "Rule",
    "format": "string"
  },
  "category": {
    "label": "Category",
    "format": "string"
  },
  "workflowName": {
    "label": "Workflow",
    "format": "string"
  },
  "nodeName": {
    "label": "Node",
    "format": "string"
  },
  "nodeType": {
    "label": "Node type",
    "format": "string"
  },
  "message": {
    "label": "Finding",
    "format": "string"
  },
  "parameterPath": {
    "label": "Parameter",
    "format": "string"
  },
  "evidence": {
    "label": "Evidence (masked)",
    "format": "string"
  },
  "remediation": {
    "label": "How to fix",
    "format": "string"
  },
  "docsUrl": {
    "label": "Docs",
    "format": "string"
  }
}
```

## About this Actor

This example demonstrates how to use [n8n Workflow Auditor - Linter & Security Review](https://apify.com/mediocre_interest/n8n-workflow-auditor.md) with a specific input configuration. Visit the [Actor detail page](https://apify.com/mediocre_interest/n8n-workflow-auditor.md) to learn more, explore other use cases, and run it yourself.


## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.
This Task's input is already configured above — use it as-is rather than inventing a new one.

- **AI agents and MCP clients** — the [Apify MCP server](https://docs.apify.com/integrations/mcp.md) at `https://mcp.apify.com` (remote, streamable HTTP, OAuth on first use).
- **Agentic workflows and local Actor development** — [Agent Skills](https://apify.com/.well-known/agent-skills/index.json) with the [Apify CLI](https://docs.apify.com/cli/docs.md): `npm install -g apify-cli`, then `apify login`.
- **JavaScript/TypeScript projects** — the official [JS/TS client](https://docs.apify.com/api/client/js/docs.md): `npm install apify-client`.
- **Python projects** — the official [Python client](https://docs.apify.com/api/client/python/docs.md): `pip install apify-client`.
- **Any other language** — the [REST API](https://docs.apify.com/api/v2.md).

For full API examples (JavaScript, Python, CLI, MCP, OpenAPI), see this Task's Actor page: https://apify.com/mediocre_interest/n8n-workflow-auditor.md

For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt).