Please do not open a public issue for security vulnerabilities.

Instead, use GitHub's private reporting: Report a vulnerability. You'll get an acknowledgement as soon as possible, and we'll coordinate a fix and disclosure with you.

FlowProof handles workflow JSON and, optionally, n8n instance credentials:

• API keys are read only from environment/config and are never logged or written to snapshots.
• The record feature (planned) redacts secrets on capture.
• Test execution is designed to produce no real side effects (mocking is mandatory; the auto-mock guard fails loudly on any unmocked impure node).

If you find a case where a credential leaks or a "safe" test performs a real external write, that's a security bug — please report it.