FlowGuard: Code Review for Automation Workflows

The Problem-> Many teams now run parts of their business on n8n automations. A web form creates a CRM contact, an AI sorts support emails, and a daily job writes and publishes blog posts. These workflows handle customer data, API keys and real money, so they are production code. But they are almost never reviewed like code. There are no pull requests and no linters, and often only the builder has ever looked at them. So workflows go live with API keys pasted in plain text, webhooks anyone can call, and steps that fail silently and lose data. They also use expensive AI models for simple jobs and have no documentation. A careful manual review takes an estimated 30–60 minutes per workflow, and still misses things. Our solution: FlowGuard-> FlowGuard is a pre-deployment reviewer for n8n workflows, built inside IBM Bob. A developer exports a workflow as JSON, switches Bob to the "FlowGuard Reviewer" mode and asks it to review the file. FlowGuard then: 1. Runs 14 rule checks in seconds. They cover hardcoded secrets, unauthenticated webhooks, SQL injection, missing retries, unhandled branches, premium AI models, frequent polling and unclear names. 2. Starts four Bob subagents in parallel: Security, Reliability, Cost and Docs. Each confirms the rule findings for its area and adds judgment findings rules cannot express. Examples are customer data sent to an AI without redaction, records processed again on every run, and AI content published without human approval. 3. Merges everything into one report with a 0–100 risk score before and after fixes. The developer receives-> - a fixed, validated workflow file for n8n - an HTML report - a flow diagram coloured by risk - test payloads, including attack-style inputs - a README for the workflow - a list of fixes that still need a human decision Who it is for-> - Automation and ops engineers who build n8n workflows - Agencies that build automations for clients - Platform and security teams approving other teams' automations What makes it unique-> Most review tools check application code. FlowGuard reviews the automation layer, which is growing fast and gets almost no review. It pairs fast, repeatable rules with parallel AI reviewers. It also returns a corrected workflow and says honestly which fixes it could not safely automate. Results-> We built six sample workflows (five with 26 planted issues, plus one clean control) and hid the answer key from Bob. - Rules alone found 21 of 26 issues (81%). - The first full run with the subagents found 25 of 26. We fixed one merge step, re-ran that workflow, and reached 26 of 26. - Zero false alarms on the control workflow, plus one real problem we had not planted. - Every fixed workflow passed re-checking with no secrets left, and gpt-4 calls were switched to gpt-4o-mini. - Reviewing all six took Bob 546 seconds, about 1.5 minutes per workflow, compared with our estimate of 30–60 minutes by hand.