Flowcasebook

Turn n8n workflow exports into client-safe case studies — locally.

Automation freelancers need portfolio proof. Raw workflow exports can expose customer data, webhook URLs, credential names, or internal identifiers. Flowcasebook creates:

• a sanitized workflow JSON file;
• a Mermaid architecture diagram;
• an evidence-aware Markdown case-study draft;
• a machine-readable privacy report.

No workflow data leaves your machine. Runtime dependencies: zero. Generated case studies describe technical facts only. Business outcomes stay explicit placeholders until a human supplies evidence.

Example

Input: a fictional lead qualification workflow with webhook, normalization, AI classification, routing, CRM, and Slack nodes.

flowchart LR
  N1["Lead webhook"]
  N2["Normalize lead"]
  N3["Classify intent"]
  N4["Qualified?"]
  N5["Create CRM lead"]
  N6["Notify sales"]
  N1 --> N2
  N2 --> N3
  N3 --> N4
  N4 --> N5
  N5 --> N6

Loading

The committed fixture uses .invalid domains and fictional identifiers. Never use a real client export as a public fixture.

Run locally

Requirements: Node.js 20 or 22.

git clone https://github.com/kanuwrld/flowcasebook.git
cd flowcasebook
npm ci
npm run build

node dist/cli.js check examples/lead-qualification.workflow.json
node dist/cli.js build examples/lead-qualification.workflow.json --out case-study

node dist/cli.js check examples/lead-qualification.workflow.json \
  --policy examples/redaction-policy.example.json

check returns exit code 1 when it finds values that need redaction. This is expected and useful in CI. Exit code 2 means invalid input or usage.

After a future npm release, the package name will be @kanuwrld/flowcasebook; the executable remains flowcasebook.

Output

case-study/
├── CASE_STUDY.md
├── privacy-report.json
├── workflow.mmd
└── workflow.sanitized.json

The privacy report includes finding type, severity, JSON path, and replacement. It never stores the original sensitive value.

Custom policies

Add client-specific redaction with a versioned local JSON policy:

• exact JSON paths from a privacy report;
• case-insensitive key globs;
• case-sensitive literal value patterns.

Policy files cannot execute code, import remote files, or interpolate environment variables. Real policies may contain private client terms, so keep them outside public repositories or name them *.policy.local.json. See the policy guide and fictional example.

Built-in detection

• email addresses and phone numbers;
• credential-bearing URLs;
• common bearer and provider token formats;
• secret-like keys such as apiKey, password, and clientSecret;
• credential metadata, workflow IDs, node IDs, and webhook IDs;
• URL and endpoint fields.

Automated redaction is best-effort. It cannot understand every client name, internal business term, or sensitive domain context. Manually review all four artifacts before publishing.

Commands

flowcasebook build <workflow.json> --out <directory> [--title <title>] [--policy <policy.json>]
flowcasebook check <workflow.json> [--format text|json] [--policy <policy.json>]

Why no AI-generated outcomes

Workflow structure proves nodes, connections, integrations, and technical safeguards. It does not prove revenue, hours saved, or conversion lift. Flowcasebook leaves business results blank instead of inventing portfolio claims.

Roadmap

• n8n parser and graph normalization
• deterministic redaction
• Mermaid diagram generation
• Markdown case-study generation
• privacy verification command
• custom redaction policies
• Make blueprint adapter
• reusable GitHub Action

See product specification for scope and evidence boundaries.

Contributing

Start with CONTRIBUTING.md. Security reports belong in a private GitHub security advisory, not a public issue.

License

MIT