Workflow review

lead_capture_crm

2 critical1 high1 medium1 low

Risk before

76 / 100

Risk after fixes

0 / 100

Findings

Fixed automatically

5 / 5

Severity	Category	Node	Issue and fix	Status
critical	security	`HTTP Request`	Authorization header contains the literal value 'Bearer pat-FAKE-DEMO-KEY-000000'; hard-coded credentials are exposed to anyone with workflow access. Fix: Remove the literal Bearer token and replace it with an n8n httpHeaderAuth credential reference.	Fixed
critical	security	`Webhook`	Webhook node has no authentication configured; any actor can POST to the endpoint and trigger the workflow. Fix: Set parameters.authentication to 'headerAuth' or 'basicAuth' and attach a credential.	Fixed
high	reliability	`HTTP Request`	Node calls the HubSpot Contacts API with no retryOnFail; any transient 5xx or network error permanently loses the lead. Fix: Set retryOnFail: true, maxTries: 3, waitBetweenTries: 2000.	Fixed
medium	reliability	`Validate Email`	The false branch of the IF node is unconnected; leads with invalid email addresses are silently dropped with no response or logging. Fix: Connect the false output to a Respond to Webhook node returning 400 or a logging node.	Fixed
low	docs	`HTTP Request`	Node still has the default generated name 'HTTP Request', making the workflow graph ambiguous. Fix: Rename to 'Create HubSpot Contact' or similar.	Fixed

Fixed workflow

criticalhighmediumlow

flowchart LR
    n0["Webhook"]
    n1["Map Lead Fields"]
    n2["Validate Email"]
    n3["Create HubSpot Contact"]
    n4["Respond Invalid Email"]
    n0 --> n1
    n1 --> n2
    n2 --> n3
    n2 --> n4
    classDef red fill:#fdecea,color:#8a1c12,stroke:#d0402b,stroke-width:1.5px
    classDef orange fill:#fdf0e3,color:#7a3a06,stroke:#d9731a,stroke-width:1.5px
    classDef yellow fill:#fbf5dc,color:#5e4b05,stroke:#b8960f,stroke-width:1.5px
    classDef blue fill:#e8f0fb,color:#153e75,stroke:#3d74c4,stroke-width:1.5px
    classDef clean fill:#f6f7f9,color:#2b3139,stroke:#c3c8cf
    class n0 red
    class n1 clean
    class n2 yellow
    class n3 clean
    class n4 clean