n8n - 💡(How to fix) Fix [Security] API Key Exposure Detection via RepoGuard

Problem

During a routine security scan of the n8n repository using RepoGuard, our tool detected potential exposed API keys or hardcoded credentials in the codebase.

Attackers exploitation scenario

1. Automated bots scan GitHub 24/7 for leaked API keys
2. Once a key is exposed, it can be exploited within minutes
3. Average financial damage per incident: $50,000+

Suggested Fix

1. Run a full scan: https://futsearch.com/repoguard/ (free for public repos)
2. Enable GitHub Secret Scanning: Settings → Security → Secret scanning (free)
3. Add RepoGuard GitHub Action to prevent future leaks: https://github.com/marketplace/actions/repoguard

Environment

• Repository: n8n-io/n8n
• Scan date: 2026-05-21
• Tool: RepoGuard API Key Leak Scanner

References

• RepoGuard: https://futsearch.com/repoguard/
• GitHub Secret Scanning docs: https://docs.github.com/en/code-security/secret-scanning/about-secret-scanning

This is a genuine security disclosure. Happy to provide more details or help investigate further.
RepoGuard is a security tool that helps developers find exposed secrets - we're not affiliated with any attacker.