Self-hosted security guidance
Security and deployment warnings
DO NOT PUT N8-M8 ON THE EDGE, EVEN WHEN AUTH IS CONFIGURED. n8-m8 can display operationally sensitive information from your n8n environment. Keep it on a private network or behind a private access layer.
Minimum deployment controls
- Do not place n8-m8 directly on the public internet, even when authentication and TLS are configured.
- Use the least-privileged n8n access available. If n8n requires a broad API key, understand that the key may be capable of more than n8-m8 intends to use.
- Protect n8n API keys, database credentials, notification webhooks, reverse-proxy secrets, and any other deployment credentials.
- Keep n8-m8, container images, dependencies, the container runtime, and the host operating system updated.
- Back up n8n and n8-m8 configuration and data. n8-m8 is not a backup system unless a feature explicitly says so.
- Do not rely on n8-m8 as your only monitoring, alerting, incident-response, audit, or compliance system.
Keep the boundary narrow
Keep n8-m8 off the public edge. Place it on a private network or behind a private access layer. Authentication and authorisation must be enforced outside n8-m8—by an external reverse proxy, identity-aware access proxy, VPN, or equivalent gateway—before traffic reaches the application.
Restrict ingress and egress to what the deployment needs, separate n8-m8 from unrelated workloads, and never expose management interfaces or container-runtime sockets. TLS protects data in transit; it does not replace identity, access, network, secret, update, or host controls.
Sensitive data surfaces
Even read-only monitoring can expose sensitive information. Workflow names, node names, credential names, execution logs, payloads, webhook URLs, error messages, screenshots, and support bundles may reveal secrets, personal information, client names, internal systems, or business processes.
n8-m8 does not intentionally fetch n8n credential secret payloads. That does not make every other field safe to disclose. Review the data available in your own environment and deploy accordingly.
Monitoring is not a security guarantee
n8-m8 is a best-effort monitoring and visibility tool. It does not guarantee detection of every security issue, data exposure, outage, failed workflow, missed execution, or configuration problem. It may report incomplete, delayed, stale, false-positive, or false-negative results.
Reporting issues
Report bugs, feature requests, and community-support questions through GitHub Issues. Do not attempt to contact the project operator directly for support.
Report suspected vulnerabilities through GitHub private vulnerability reporting . Never publish exploit details, secrets, personal information, or customer data in a public issue.