Auto-detect and remediate secret leaks from GitHub repos with n8n

GitHub push events → regex secret scan → AI classification → auto-revoke AWS keys / create Jira tickets / Slack alerts

Who

DevOps and security teams with an n8n instance, GitHub repos, and credentials for AWS, Jira, and Slack

You get

Automatically scan commits for high-impact secret leaks and respond by disabling AWS keys, creating Jira tasks, and sending Slack alerts

You need

n8n · slack · data-table

Steps

1. Configure trigger and code extraction

   Import the template into n8n. Configure the GitHub Trigger node: select the repository and push event, using oAuth2 authentication. The Code node parses the webhook body to extract added/modified files from the commit and builds raw URLs. The HTTP Request node fetches raw file contents using the githubOAuth2Api credential.

2. Regex scan, deduplication, and aggregation

   The Code node (RegEx Scanner) runs regex matches against file contents: AKIA[0-9A-Z]{16} for AWS keys; sk_live_/pk_test_ patterns for payment processor keys; postgres:// and similar protocols for database URLs. Results are hashed by a Code node, then checked against the processed_secrets DataTable (rowNotExists). Unprocessed items are aggregated into a single data object.

3. AI classification and response decision

   The AI Agent node (AI - Classifier) connects to the OpenRouter Chat Model (anthropic/claude-sonnet-4.6). Aggregated leak data is passed to the AI, with a systemMessage defining the security analyst role and requiring STRICT JSON output selecting one of four actions. The Code - Formatter node parses JSON blocks from the AI output for downstream use.

   Execution prompt · Source text。AI - Classifier node text field (user message)

   Copy prompt

   =A GitHub commit triggered the secret leak detector.
   
   Detected secrets:
   {{ JSON.stringify($json.data, null, 2) }}
   
   Analyze each finding and decide the appropriate security response.
   Return JSON only.

   Execution prompt · Source text。AI - Classifier node options.systemMessage field

   Copy prompt

   You are a Security Incident Response Analyst.
   
   You receive detected secrets from a Git commit. Detection is already verified.
   Your job is ONLY to decide the correct response action and generate messages for Jira and Slack.
   
   You must choose ONE action from this fixed list:
   
   - REVOKE_AWS_KEY
   - PAYMENT_PROCESSOR_KEY_ALERT
   - ROTATE_DB_PASSWORD
   - IGNORE_KEY
   
   Rules:
   
   1. If detected_type = AWS_ACCESS_KEY
      → action = REVOKE_AWS_KEY
   
   2. If detected_type = PAYMENT_PROCESSOR_KEY
      → action = PAYMENT_PROCESSOR_KEY_ALERT
   
   3. If detected_type = DATABASE_URL
      → action = ROTATE_DB_PASSWORD
   
   4. If the leaked_value is clearly fake, placeholder, or test data
      → action = IGNORE_KEY
   
   You must return STRICT JSON (no markdown, no explanation).
   
   For EACH detected item, return:
   
   {
     "leaked_value": "...",
     "hash_leaked_value": "...",
     "detected_type": "...",
     "action": "...",
     "jira_tickets": "...",
     "slack_message": "..."
   }
   
   The jira_tickets field must be a short title + description.
   The slack_message must be a short urgent security alert.
   
   Do not return arrays. Return one JSON object per input item.

4. Switch-branch automated response

   The Switch node routes by action field: REVOKE_AWS_KEY calls AWS IAM GetAccessKeyLastUsed to obtain the username, then UpdateAccessKey to set the key to Inactive, sends a Slack alert, and saves to DataTable. PAYMENT_PROCESSOR_KEY_ALERT and ROTATE_DB_PASSWORD branches each create a Jira Task and send a Slack alert, then save to DataTable. IGNORE_KEY ends the workflow. Slack messages use the AI-generated slack_message field. Node expression (Slack): ``` ={{ $('Switch').item.json.slack_message }} ```