What an export can contain
Normal n8n exports should not include the secret itself. They can still include credential names, account IDs, live links, and test data. Treat every export as private until you check it.
Remove before publishing
- credential IDs and account-specific credential names;
- live webhook paths and webhook IDs;
- Airtable base/table IDs and cached resource names;
- Google Drive and folder IDs;
- execution or pinned sample data;
- instance IDs, emails, customer data, and internal URLs;
- bearer tokens, API keys, authorization headers, and cookies.
Preserve what makes it useful
Keep node order, expressions, prompts, model roles, parser logic, field mappings, retry design, and explanatory node notes. Replace resources with unmistakable placeholders such as REPLACE_WITH_AIRTABLE_BASE.
Build-time verification
The site makes public copies from the supplied files, checks for common keys, tokens, emails, and live webhooks, and stops the build if it finds one.
Manual final check
Automated pattern matching cannot understand every proprietary identifier. Open the public JSON once, search for your company name, email domain, live hostname, customer names, base ID, drive ID, and any string copied from a credential screen.