Ask what is prompt injection in the abstract and you get a definition. Ask it about your own workflow and you get a list: the API key typed into a node and stored in every export, the code node sitting one hop downstream of the model, the credentials Sekoia reported being harvested from exposed Flowise servers on October 22, 2026. Paste your Flowise, Langflow or n8n export below — the analysis runs entirely in your browser, and you will see exactly what your workflow is leaking.
Short answer: your exported workflow file itself. A Flowise, Langflow or n8n export stores node parameters verbatim, so a key typed into a node is a key written into every export, backup and shared copy — 100% of the credentials stored in an exposed workflow travel with the file, per Sekoia's October 22, 2026 reporting on harvested Flowise credentials. Add a privileged node downstream of the model, and the same file also documents the attack path.
On October 22, 2026, Sekoia reported that attackers were harvesting credentials from exposed Flowise servers — instances of the popular visual agent builder left reachable on the internet, their saved workflows holding the API keys, database passwords and service tokens the builders had typed into nodes. The attackers did not need an exploit in the traditional sense: the workflows were the vault, and the vault was open.
Flowise is one name for a general shape. Langflow and n8n exports have the same property: a workflow file is a complete description of an automation, including its parameters, and parameters are where credentials live. Teams export workflows to share them, back them up, post them in forums for help, and commit them to repositories — each copy carrying the keys in plaintext, readable by anyone who opens the file.
The second leak in the same file is structural. The export also records which nodes connect to which, so it shows whether a language-model node — the component that reads untrusted text — can reach a code, HTTP or database node. That path is the prompt-injection kill chain, drawn by the workflow's own author: hostile content reaches the model, the model steers the flow, and the privileged node at the end executes. The analyzer below checks both leaks, in your browser, on the file you paste.
Prompt injection is an attack where hostile instructions hidden in content a language model reads — a web page, an email, a document, a tool result — override the instructions the model's owner gave it. The model cannot reliably separate data from commands, so text that arrives as input can act as orders. On its own, a hijacked answer is embarrassing. Wired into a workflow where the model's output flows to code execution, HTTP requests or database queries, it becomes remote control — which is why the reachability walk in the analyzer matters as much as the credential scan.
Paste a Flowise, Langflow or n8n export (the full JSON). The analyzer parses it here in your browser, scans for credential patterns and plaintext credential fields, detects privileged nodes (code, shell, HTTP, SQL), and walks the workflow's own edges from LLM nodes to see which privileged nodes they can reach. Findings show secrets redacted to the first 4 characters only. Nothing is uploaded — there is no server behind this page. Or load a sample first: the leaking sample carries a demo key and an LLM-to-code-to-HTTP chain; the clean sample uses an environment reference and no privileged nodes.
Honest scope note: this analyzer reads the single export you paste: it cannot see credentials stored server-side in the builder's own database, other workflows on the same instance, or whether your Flowise server is internet-exposed right now — check exposure separately. Pattern matching also cannot catch keys in unusual formats. The full tool is the open-source agent-workflow-leak-auditor repo by Ingenious AI, which audits whole instances and export folders.
| Finding | Severity | Why it matters |
|---|---|---|
| Credential pattern in the export (sk-, AKIA, ghp_, xox, private keys, JWTs) | CRITICAL | The key is in the file, in plaintext. Every copy of the export is a copy of the key. Rotate first; deleting the line does not un-leak it. |
| Plaintext credential field on a node | HIGH | The builder stored the secret as a parameter instead of a reference. Exports, backups and shared templates all inherit it. |
| Privileged node reachable from an LLM node | HIGH | The prompt-injection kill chain in one hop: untrusted text steers the model, the model's flow reaches code, HTTP or SQL execution. |
| Privileged node present (not LLM-reachable) | MEDIUM | Legitimate in many designs, but it defines the blast radius if any upstream path changes — re-check after every workflow edit. |
If the analyzer flags your export, the file has already been a credential copy everywhere it has been — work this list in order:
Prompt injection is hostile instruction text hidden in content a language model reads, which the model then obeys as if its owner wrote it. In a workflow the stakes are higher than a wrong answer: if the model's flow reaches a code, HTTP or database node, the injected text can steer real actions. The reachability walk on this page maps exactly that path in your export.
Because builders store what you type. A key entered into a node becomes a parameter, parameters are written verbatim into export JSON, and exports get shared, backed up and committed. Sekoia's October 22, 2026 report documented attackers harvesting exactly these stored credentials from exposed Flowise servers — no exploit needed, just access to the files.
Yes — the analysis runs entirely in your browser with JavaScript on this page. Nothing is uploaded, stored or transmitted, and any secret the analyzer finds is displayed redacted to its first 4 characters. That said, good practice is to rotate any real key you find in an export regardless of where you found it, because the export itself is the leak.
Rotate it: revoke the old value and issue a new one, then replace the typed-in value in the workflow with an environment or credential-store reference and re-export. Deleting the key from the file is not enough — every existing copy of that export, including git history and backups, still holds a working credential until it is revoked.
This page analyzes the one export you paste. The full agent-workflow-leak-auditor scans entire export folders and builder instances, inventories every workflow's credentials and privileged paths at once, and tracks findings across versions — use it for a complete audit rather than a single-file check.