321 Live n8n Instances Exposed via API Tokens in Public GitHub Repos

Wed, 05 Aug 2026 13:01:27 +0000

Engineer — Act: If your org runs n8n, scan your GitHub repos immediately for exposed API tokens using GitGuardian or truffleHog, then rotate any identified credentials and review what downstream integrations those tokens had access to.
SOC/IR — Plan: The four documented abuse paths (credential pivoting via workflow API) are worth translating into detection queries for anomalous n8n API calls; build coverage for unexpected data exfiltration from workflow automation platforms this quarter.
Leader — Learn: This research illustrates how workflow-automation tools become credential aggregators — a useful data point for a secrets-management policy review, but no same-week leadership action is indicated unless n8n is confirmed in use with public-facing repos.

Spring Boot /actuator/heapdump endpoint exposes secrets in memory

Mon, 27 Jul 2026 13:44:31 +0000

Engineer — Act: Audit all Spring Boot deployments for exposed /actuator/heapdump endpoints — this endpoint leaks in-memory secrets including API keys and DB credentials. Disable or restrict actuator endpoints via Spring Security configuration if not required.
SOC/IR — Plan: Build a detection for inbound GET requests to /actuator/heapdump in web/proxy logs; active scanning activity means attackers are already probing for this endpoint in your estate.
Leader — Skip