Unpopular opinion: most n8n workflows aren't broken by the AI. They're broken by four plumbing decisions around it — and those same four decisions decide what an attacker can do if they ever get inside.

This isn't a fear-mongering post. It's an infrastructure one. Security, done well, isn't a separate checklist bolted on afterward — it's a side effect of building the boring parts correctly the first time. Here's what that looks like in practice, and why each habit contains damage, not just prevents it.

  1. Don't build one mega-workflow. Split long flows into smaller, isolated workflows instead of one automation that tries to do everything from trigger to final action. Each piece stays small, each piece's secrets stay scoped to what it actually needs — and if one step is ever compromised, whoever got in can't pivot sideways through the rest of the chain, because the rest of the chain was never reachable from where they landed.
  2. Don't connect tool nodes directly to anything with a credential. Move them behind an MCP server instead of wiring API keys straight into the canvas. Authentication lives on the MCP layer, not in the workflow's own JSON — so a leaked export, a shared canvas, or a careless handoff never hands over the actual keys along with it.
  3. Don't feed mixed inputs to the model raw. Chat, email, a form, an API call — each arrives in a different shape. Normalize all of them into one schema before anything reaches the AI node. That normalization step is also the gate: it's where you reject or quarantine anything that doesn't fit the expected shape, instead of passing whatever showed up straight to a model that will do its best to interpret garbage as intent.
  4. Don't trust the happy path. Add an Error Trigger, a retry-on-fail with a sane cap, and a fallback branch that actually alerts a human. Silent failures are how an attacker moves around unnoticed just as much as they're how a real customer's request quietly disappears — the alert is what turns “we found out three days later” into “we noticed at 3am.”

None of these four are exotic. They're the boring parts of building automation properly. The interesting parts — the AI reasoning, the clever prompt — are usually the part that already works by the time anyone asks for help. It's the plumbing that decides whether the whole thing survives contact with production, and with anyone who shouldn't be there.