n8n_workflows

CRITICAL: Multiple workflows contain hardcoded API keys (e.g., for EODHD, Brave Search, BuzzSumo, NYT Article Search, Firecrawl). These should always be stored securely as environment variables or N8N credentials, not directly in workflow JSONs or code. CRITICAL: The 'chat-with-a-database-using-ai-.json' workflow passes AI-generated SQL directly to a PostgreSQL query, creating a severe SQL injection vulnerability if the AI agent's output can be manipulated by malicious user input. HIGH: The Docker Compose configuration uses default, weak credentials ('admin@admin.com'/'admin') for PgAdmin, which is unsuitable for any non-local development environment. MEDIUM: Extensive use of 'jsCode' nodes, while necessary for complex logic in N8N, increases the attack surface for potential vulnerabilities if not meticulously reviewed and secured, especially when processing external or AI-generated inputs. MEDIUM: The 'generate-swagger-specs-for-workflows-with-webhooks-.json' writes files to a mounted directory (`/swagger-html`), which, despite the `N8N_RESTRICT_FILE_ACCESS_TO` environment variable, introduces a file system write risk.