Orb44 — automation panel example: open n8n editor

A different kind of exposure than a CMS plugin: a look inside the automation stack, not just the storefront. Not a named team. Not a pentest.

What was open

The n8n editor answered without login. Anyone who found the address could read workflows, including API keys and webhook secrets stored inside them.

What changed

The owner put the panel behind a login or VPN and rotated every credential the workflows had exposed.

Read-only check

This check never opens the editor itself or runs a workflow — GET only. It never touches n8n, Flowise, Langflow, or Dify beyond confirming the panel answers.