Free Verify scan · n8n-io/n8n

n8n guards the merge. Not the release.

Canon Verify read n8n's public repository and scored it 80/100, third of 69 repos assessed. Review and CI rank near the top. The path to production doesn't: no named deploy approver, write-by-default workflow tokens, and no build provenance.

Commit 447fc86 · 132 controls · Oct 16, 2026 · Re-checked daily

Scanned with public access only. Customer results are never published.

Delivery controls score80

n8n

42median 6886

Out of 100. Stronger than 94% of the 68 other assessed repositories.

Score

80/100

Rank 3 of 69 · median 68

Gaps

11 fewer than the median of 33

Critical

3 controls

1 root cause

Not visible

Needs admin access

What n8n does wellDefault branch identifiedBranch strategy observableDefault branch protected by rulesetForce-push restrictedPull-request requirement on default branch

Gaps22

n8n

15median 3361

Visible controls Verify found unmet. Fewer is better. Stronger than 93% of the 68 other assessed repositories.

How does your team compare?

This is what Canon Verify found in n8n's public configuration. Your team's process probably has the same gaps. Most private repos do.

See how your team scores

5 minutes. No repository access needed.

Scan your own repo with Verify (free)

Analysis

Our read

The review process is real.

Pull requests are required, force-push is blocked, and the default branch is under a ruleset. 20 of 23 review controls pass.

Production is the soft spot.

Three critical controls fail on one fact: the production environment has no resolved reviewers. Anyone who can run the deploy workflow can ship.

The supply chain trusts itself.

Workflows default to write tokens, deploys use long-lived keys instead of OIDC, and packages publish without provenance. A compromised action could push code or cut a release, and downstream users couldn't tell.

Priority

Fix these first

critical

Gate production

Covers 3 controls

Production protection
Production reviewers resolved
Production approvers named

What Verify read

No resolved production reviewers.

Risk: Anyone who can run the deploy workflow can ship to production.

yaml

# Settings → Environments → production → Required reviewers: <release-team>
jobs:
  deploy:
    environment: production

Have this gap too? Start from the Release Gate flow.

Open in Design

high

Scope workflow tokens

Covers 2 controls

Default workflow token read-only
Workflow permissions least-privilege

What Verify read

At least one workflow grants write permissions at the top level or declares none.

Risk: A compromised action gets a token that can push code or publish a release.

yaml

permissions:
  contents: read

medium

Prove the build

Covers 3 controls

Package provenance
Artifact attestation
Provenance or attestations

What Verify read

No provenance or attestation step was found in the workflows.

Risk: Downstream users can't confirm a package or release came from this repository.

yaml

permissions:
  id-token: write
  attestations: write
steps:
  - run: npm publish --provenance
  - uses: actions/attest-build-provenance@v2
    with:
      subject-path: dist/*

Overview

Control map

Public-access limit

16 controls this scan couldn't read

This free scan used public access only. These controls live in settings only a repository admin can read. Verify checks them on your connected repository.

Administrator bypass restrictedhigh
Tag protectionhigh
Self-merge restrictedhigh
Owners resolve to principalshigh
Bypass actors justifiedhigh
Push protection enabledhigh
Dependabot alertshigh
Secret scanning alertshigh
SAST required on default branchhigh
Environment secrets scopedhigh
Secret custodiansmedium
Agent identity in commitsmedium
Audit of agent actionsmedium
Audit of privileged actionsmedium
Private vulnerability reportinglow
Wait timer or freeze windowlow

Get Verify

Method

How Verify works

Read

Verify reads the repository at a pinned commit: settings, rulesets, workflows, and files.

Judge

Each control is checked against a written expectation. Same inspector, same criteria, every repository.

Prove

Every result shows the evidence Verify read. Assessments re-run daily, and changes are logged.

132 controls · 69 repositories assessed · re-run daily

	This free scan	Verify on your repository
Access	Public	GitHub App you install
Controls read	108 of 108	All 108
Private repositories	No	Yes
Results	Published here	Private to your organization

Evidence locker

Every control Verify checked

Governance

8 of 12 pass

Review

19 of 26 pass

CI & tests

26 of 30 pass

Code quality

5 of 8 pass

Security

10 of 20 pass

Release & ops

7 of 22 pass

Docs

5 of 6 pass

Assessment timeline

Canon re-assesses this repository daily. An entry appears only when something changed — the score, a control's outcome, or a control ceasing to apply.

Sep 21 · 80Oct 16 · 80

Oct 7, 2026Owners resolve to principals · Review — confirmed → needs repository admin access6d1144c

Get this report for your own repository.

Canon Verify runs the same inspection on your private repo. Read-only GitHub App. First scan free.

Scan your repo free See how your team scores

Read-only access. No code stored. How Canon handles your data →

View n8n-io/n8n on GitHub

Maintain n8n? If anything here is inaccurate or out of date, email security@strikelabs.co and we'll correct it.