# Monitor exposed secrets in GitHub and CI logs with WhatsApp: n8n workflow

> Started by a clock, and works across WhatsApp. 27 steps, 5 branches, 2 loops or waits: large, and worth reading before you trust it with anything live.

Source: https://millionrounds.com/workflow/monitor-exposed-secrets-in-github-and-ci-logs-with-whatsapp (Millionrounds; every figure on the page links to its filing or article)

[Automation library](https://millionrounds.com/workflows) · [Alerts and monitoring](https://millionrounds.com/workflows?category=Alerts+and+monitoring#library)

# Monitor exposed secrets in GitHub and CI logs with WhatsApp

Started by a clock, and works across WhatsApp. 27 steps, 5 branches, 2 loops or waits: large, and worth reading before you trust it with anything live.

Large

[Download free](https://millionrounds.com/login?next=%2Fapp%2Fworkflow%2Fmonitor-exposed-secrets-in-github-and-ci-logs-with-whatsapp)

**27 steps** Large: read it before trusting it with anything live

**5** Branches: places the flow splits

**2** Loops or waits

**1** Service it connects to

## The flow

Starts it 2 Logic 17 Service 8

The steps in the order they run, from what starts it.

- 1 **Schedule Trigger - Every 6 Hours** Schedule trigger *Starts it*
- 2 **Manual Trigger - Test Run** Manual trigger *Starts it*
- 3 **Set - Config** Set *Logic*
- 4 **HTTP Request - Fetch Recent Repository Commits/Diffs** Http Request *Service*
- 5 **HTTP Request - Fetch CI/CD Pipeline Logs** Http Request *Service*
- 6 **JS - Scan Content for Secret Patterns & Compute Entropy Scores** Code *Logic*
- 7 **Switch - Secret Type Category** Switch *Logic*
- 8 **Set - Cloud Verification Params** Set *Logic*
- 9 **Set - VCS Verification Params** Set *Logic*
- 10 **Set - Payment Verification Params** Set *Logic*
- 11 **Set - Mark Unverifiable (Generic)** Set *Logic*
- 12 **HTTP Request - Verify Credential Validity** Http Request *Service*
- 13 **JS - Classify Risk & Build Remediation Plan** Code *Logic*
- 14 **IF - Is Reverification Pass** If *Logic*
- 15 **Switch - Severity Routing** Switch *Logic*
- 16 **IF - Still Valid After Remediation** If *Logic*
- 17 **WhatsApp - Send Urgent Alert** Whats App *Service*
- 18 **WhatsApp - Send Standard Notification** Whats App *Service*
- 19 **Set - Logged Only (No Notification Needed)** Set *Logic*
- 20 **WhatsApp - Send Escalation (Still Active)** Whats App *Service*
- 21 **Set - Confirmed Revoked & Closed** Set *Logic*
- 22 **Wait - For Remediation Confirmation** Wait *Logic*
- 23 **WhatsApp - Send Resolution Confirmed** Whats App *Service*
- 24 **IF - Remediation Confirmed** If *Logic*
- 25 **Wait - For Re-Verification Grace Period** Wait *Logic*
- 26 **WhatsApp - Send Reminder (Not Yet Remediated)** Whats App *Service*
- 27 **Set - Prepare Reverification** Set *Logic*

## How it's built

- **Starts on:** A clock
- **Steps:** 27, with 5 branches, 2 loops or waits
- **Size:** Large: read it before trusting it with anything live
- **Connects to:** WhatsApp
- **Model:** None. This is plumbing, not judgement

## Questions

What does it need to run?

An n8n account, plus your own WhatsApp account. You connect your own accounts after importing it; none are included.

What starts it?

It starts on a clock.

Does it use AI?

No. Every step is fixed logic or a call to a service, so it does the same thing every time.

How long does it take to set up?

Take your time. At 27 steps it is large: read it before trusting it with anything live.

How do I import it?

Copy the workflow, open a new workflow in n8n and paste. The steps appear on the canvas, ready for your own accounts.

**Before you run it**

Nothing here has been tested by us. It is somebody's working automation, read and described from its own steps. Treat the connections it wants as a list of accounts it will touch, and read the 27 steps before you point it at anything that matters.

## Run it in n8n

- **Create your n8n account** Free to start. n8n is where the workflow runs. [Create an n8n account ↗](https://millionrounds.com/n8n)
- **Download the workflow** Free with a Millionrounds account. [Download free](https://millionrounds.com/login?next=%2Fapp%2Fworkflow%2Fmonitor-exposed-secrets-in-github-and-ci-logs-with-whatsapp)
- **Paste it into n8n** Open a new workflow in n8n and paste. Then connect your own accounts.

Stored with the author's traces removed: canvas notes, instance identifiers, saved credential names and any live document they had left behind.

## Connects to

Each opens the other workflows that use it.

[WhatsApp](https://millionrounds.com/workflows?service=WhatsApp#library)

## Workflows like it

Also alerts and monitoring, with the same services where possible, closest in size first.

- [**Email cleaner with Gmail and WhatsApp** 28 steps · Gmail, WhatsApp](https://millionrounds.com/workflow/email-cleaner-with-gmail-and-whatsapp)
- [**Triage AWS security posture changes with Claude and Slack** 28 steps · calls a model · Email, Slack](https://millionrounds.com/workflow/triage-aws-security-posture-changes-with-claude-and-slack)
- [**Monitor engineering health across ClickUp, GitHub and APM** 25 steps · WhatsApp](https://millionrounds.com/workflow/monitor-engineering-health-across-clickup-github-and-apm)
- [**Monitor engineering health with ClickUp and GitHub** 25 steps · WhatsApp](https://millionrounds.com/workflow/monitor-engineering-health-with-clickup-and-github)
- [**Diagnose incident root causes and plan remediation with Claude** 30 steps · WhatsApp](https://millionrounds.com/workflow/diagnose-incident-root-causes-and-plan-remediation-with-clau)
- [**Predict and prevent service failures with Claude and ClickUp** 30 steps · WhatsApp](https://millionrounds.com/workflow/predict-and-prevent-service-failures-with-claude-and-clickup)