// the take
This is a single README listing 100 n8n workflow *ideas* for security automation — recon, SOC/DFIR, AppSec/DevSecOps, and general platform security — each with a purpose, integration list, and one-line flow outline. It's aimed at security engineers who already use n8n and want a brainstorming reference for what to build, not a library of workflows you import and run.
The taxonomy is genuinely broad and consistently structured — every entry follows the same Purpose/Integrations/Flow format, which makes it skimmable and easy to pick ideas from. It names real, specific tools throughout (Subfinder, Semgrep, ZAP, Trivy, Checkov, VirusTotal, urlscan.io) rather than vague buzzwords, so it doubles as a decent map of what's integratable into a security automation pipeline. The 'Import & Build Tips' section gives a few concrete, correct n8n node choices (HTTP Request for APIs, Execute Command for scanners, Split In Batches for lists) that someone new to n8n would find useful.
The description promises '100+ workflows... ready-to-run playbooks' but the repo contains no actual n8n workflow JSON — just prose. Every one of the 100 entries is a one- or two-sentence flow sketch you have to design and build yourself; there are no node configs, credential setups, example payloads, or error handling shown anywhere. Several offensive-security entries (credential spraying orchestrator, malicious macro build conveyor, AV/EDR evasion test matrix) get a '(Lab/Test Only)' tag and nothing else — no discussion of authorization scoping, safe-guards, or legal considerations beyond that label. There's been no activity since the initial push in September 2025, so it reads as a one-time idea dump rather than a maintained resource.
We read the README, the directory tree and a key source file in October 2026. Nobody pays to be listed. How we judge →