Template preflight
Flags explicit unresolved markers before a workflow definition is handed off or imported.
Day 057 / n8n / Workflow Automation
Secret Placeholder Checker
/ Overview
A dependency-free Python CLI that finds unresolved secret placeholders in bounded workflow JSON without printing the values it inspects.
Workflow templates can reach a handoff or deployment with unresolved credential placeholders still present. A useful preflight needs to find obvious markers while avoiding broad secret detection claims and keeping inspected values out of its reports.
/ Provided servicesClear thinking.
Clear thinking.
Practical delivery.
Context-aware checks
Treats bracketed templates as findings only when their JSON key looks credential-related.
Data-minimized output
Returns paths and generic codes without copying inspected values into logs or reports.
/ Solution
Secret Placeholder Checker recursively scans one bounded local JSON document for exact markers such as CHANGE_ME, structured YOUR_*_HERE tokens, bracketed templates in credential-like fields, and empty credential-like fields. It reports only the JSON path and a generic finding code, with text and JSON modes plus workflow-friendly exit codes. It does not detect real secrets, connect to n8n, inspect remote credentials or guarantee that a workflow is ready to deploy.
/ Impact
Four conservative finding classes
Nested object and array traversal
Value-free finding reports
100 KB input boundary
Depth and value-count limits
Duplicate-key rejection
Text and JSON output
Ten standard-library tests
Python standard library
Argparse, JSON, pathlib and regular expressions provide a dependency-free offline CLI.
Bounded traversal
Recursive scanning enforces file-size, depth and value-count limits before producing deterministic findings.
Unittest
Ten tests cover each finding class, ordinary content templates, nested paths, duplicate keys and traversal limits.