Automate Privacy Leak Detection for Your Projects — Weekly Security Scan in 15 Minutes

The Problem

You have projects with dozens of files: markdown articles, JSON workflow exports, Python scripts, config files. Any one of them can accidentally contain:

The problem isn't that these leaks happen — it's that you won't know until someone finds them. A leaked credential in a public repo or dashboard can cost $5,000 to $50,000+ in damages, depending on the exposure.

Manual audits don't work. You forget. You get busy. And the one time you skip it is the one time something slips through.

This workflow gives you a fully automated privacy scanner that runs weekly, alerts you immediately if anything changes, and costs exactly $0.

The Stack

Total cost: $0 — all tools are built-in or free.

Step 1: Understand What You're Scanning For

Before building the scanner, here are the categories of private data to detect:

Each category gets its own scan function, making the system modular and easy to extend.

Step 2: Build the Scanner Script

Create a single bash script called `check-privacy.sh` that runs all scans and generates a markdown report.

Scan Functions

Each scan uses `find` + `grep` with smart exclusions:

# Scan for emails (excludes project-owned domains and placeholders)

check_emails() {

  find "$TARGET" -type f \( -name '*.md' -o -name '*.json' -o -name '*.py' ... \) \

    ! -path '*/node_modules/*' ! -path '*/.git/*' \

    -exec grep -HnoE '[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}' {} + \

    | grep -vi 'example\.com\|your@\|test@\|@domain\|flowforge@toolyft.com'

}

The key patterns:

Exclusion Lists

Equally important is what not to flag:

Report Format

The script generates a timestamped markdown report:

# Privacy Scan Report — 2026-06-20 02:16

Target: /home/user/projects



## 📧 Non-Project Emails

✅ None found



## 🏢 Company / Client Names

✅ None found



---



✅ Result: CLEAN — no privacy issues detected

Reports are saved to `~/project-privacy-reports/report-YYYY-MM-DD.md` for historical tracking.

Quiet Mode for Automation

A `--quiet` flag makes the script return exit codes only — 0 for clean, 1+ for issues found. This is what cron and n8n use:

check-priv --quiet && echo "Clean" || echo "Issues found"

Step 3: Install and Run Your First Scan

# Make executable

chmod +x scripts/check-privacy.sh



# Install as global command

sudo ln -sf $(pwd)/scripts/check-privacy.sh /usr/local/bin/check-priv



# Run your first scan

check-priv



# Quick check only

check-priv --quiet; echo "Exit: $?"



# View last report

check-priv --report

On first run, expect some false positives — that's normal. Add exclusions for:

Tune the exclusion lists in the script until `--quiet` returns 0. Then automation begins.

Step 4: Automate with cron

Add a weekly cron job to scan every Sunday at 3am:

# Open crontab

crontab -e



# Add this line:

0 3 * * 0 /usr/local/bin/check-priv --quiet && \

  echo "[$(date)] ✅ Clean" >> /tmp/check-priv-history.log || \

  echo "[$(date)] ⚠️ Issues found" >> /tmp/check-priv-history.log

The log file accumulates a running history:

[Sat Jun 20 03:00:01 UTC 2026] ✅ Clean

[Sat Jun 27 03:00:01 UTC 2026] ✅ Clean

[Sat Jul 4 03:00:01 UTC 2026] ⚠️ Issues found

No mail server needed. No external services. Just a log file you check when you remember — or better yet, integrate with n8n for alerts.

Step 5: n8n Integration — Webhook-Triggered Scans with Email Alerts

The weekly cron log is passive. Active alerts require a webhook that n8n can call, which then emails you when issues are found.

Architecture

n8n (Docker container)

  → POST to host webhook server (port 9199)

    → check-priv runs on the host

      → Returns report JSON to n8n

        → If issues found: send email alert

Setting Up the Webhook Server

If you already have a pipeline webhook server running (like the FlowForge publish pipeline), add a new endpoint:

# In your pipeline-webhook-server.py — add this handler

elif parsed.path == "/webhook/check-priv":

    result = self._run_check_priv()

    self._send_json(200, result)

The `_run_check_priv` method executes `/usr/local/bin/check-priv` and captures its output:

def _run_check_priv(self):

    result = subprocess.run(

        ["/usr/local/bin/check-priv"],

        capture_output=True, text=True, timeout=120

    )

    return {

        "clean": result.returncode == 0,

        "exit_code": result.returncode,

        "report": result.stdout

    }

The n8n Workflow

The workflow has 4 nodes:

The HTTP Request node configuration:

URL: http://172.18.0.1:9199/webhook/check-priv

Method: POST

Headers:

  X-Pipeline-Token: {{ $env.PIPELINE_TOKEN }}

When the scan finds issues, the email alert looks like:

Subject: ⚠️ Privacy Scan Alert — Issues Found

Body:

  Privacy scan detected potential leaks in your project.

  Run 'check-priv --report' on the server for full details.

  

  Summary:

  - 1 company/client name(s) flagged

  - 1 credential reference(s) found

Step 6: Interpreting Results

When the scanner reports issues, here's how to evaluate each category:

Recommended action by severity:

🔴 Critical — API keys, passwords, embedded URL creds → Rotate immediately, scrub from git history

🟡 High — Real emails, phone numbers, company names → Remove from public files, update dashboards

🟢 Low — n8n credential IDs, public IPs, false positives → Document and exclude from future scans

Variations

Variation 1: Multi-Project Workspace (30 min setup)

If you have multiple projects in a workspace directory, run the scanner from the parent:

check-priv /home/user/workspace

Or create a wrapper that scans each project individually and aggregates results:

for dir in /home/user/workspace/*/; do

  check-priv "$dir" --quiet || echo "⚠️ Issues in $(basename $dir)"

done

Variation 2: CI/CD Integration (1 hour setup)

Run the scanner as part of your deployment pipeline:

# Before deploy

if ! check-priv --quiet; then

  echo "❌ Privacy scan failed — deploy blocked"

  check-priv --report | mail -s "Privacy Blocked Deploy" team@project.com

  exit 1

fi

This prevents any file with potential leaks from reaching production.

Variation 3: Slack/Teams Alert (30 min setup)

Replace the email node in n8n with a Slack webhook node or Microsoft Teams connector. Instead of email, the alert goes directly to your team chat:

n8n → IF (issues found) → Slack Webhook → #security-alerts

Your whole team sees the alert in seconds.

Troubleshooting

"The scanner flags my own email address"

Add it to the exclusion list in the `check_emails` function:

| grep -vi 'you@yourproject.com\|admin@yourdomain.com'

"Too many false positives from n8n JSONs"

The credential UUIDs in n8n workflows look like secrets but are just database row identifiers. The scanner already filters UUID patterns. If you still see false positives, add the specific credential IDs to the exclusion filter.

"cron doesn't run the scan"

Check the cron log:

grep -i "check-priv" /var/log/syslog

Common issues:

"n8n workflow returns 403"

The webhook server requires the auth token. Make sure the `X-Pipeline-Token` header matches what's configured in your systemd service file:

sudo grep PIPELINE_TOKEN /etc/systemd/system/flowforge-pipeline-webhook.service

"The scan takes too long"

Limit the file types or directories scanned. The biggest slowdown is usually `node_modules` — the script already excludes it. If scanning a very large repo, narrow the `find` scope:

# Only scan specific directories

find articles/ scripts/ n8n-workflows/ ...

Why This Workflow Wins

Before automated scanning, privacy was a manual checklist you'd forget. You'd do a quick grep before a big launch, find nothing obvious, and call it done. The one time you missed something was the one time it mattered.

After automated scanning, privacy is a continuous process. Every Sunday at 3am, the scanner runs. If clean, you never hear about it. If not, you get an alert within seconds. The report archive gives you a paper trail. The n8n integration gives you active alerts.

Set it up once. Tune it for a week. Then forget about it — until the day it catches something that would have cost you thousands.

Related Workflows