n8n: exposed automation
Webhook URLs hardcoded in frontend JavaScript — accessible to any visitor.
What we found
On a training platform, an n8n webhook allowed unauthenticated admin account creation. Exploitation time: 2 minutes.
How to secure
Related articles
Three adjacent analyses to keep exploring the same attack surface.
Payroll webhooks to accounting: signature, replay, and data in transit
Webhooks leaving a payroll tool for an accounting system carry sensitive amounts. What to actually verify.
Firebase Firestore: why 'allow read, write: if request.auth != null' is not security
The basic Firestore authentication rule doesn't protect your data. Here's why and how to fix it.
GraphQL API: 6 vulnerabilities that scanners don't detect
Introspection enabled, depth attacks, batching, IDOR via relay IDs — GraphQL flaws invisible to automated tools.
Sources
Editorial analysis based on official vendor, project, and regulator documentation.
Related services
If this topic maps to a real risk in your stack, these are the most relevant CleanIssue audits.