🔓 Unlock all 10,000+ workflows & prompts free Join Newsletter →
✅ Full access unlocked — explore all 10,000 AI workflow and prompt templates Browse Templates →
Home › n8n › Workflow
January 22, 2026

OpenAI + Google Drive, shareable code scan reports

OpenAI + Google Drive, shareable code scan reports - n8n workflow automation template
Lisa Granqvist Partner Workflow Automation Expert
OpenAI + Google Drive, shareable code scan reports - n8n workflow automation template
Get a free AI assessment → Get a free AI assessment → ⬇️ Use template

You run a quick code scan, spot something worrying, then lose another hour turning messy notes into something you can actually send. The switching is the worst part. Tabs, screenshots, copy-paste, “where did that snippet come from?”

This kind of OpenAI Drive reports setup hits security consultants first, honestly. But in-house engineering leads and bug bounty hunters feel the same drag when they need clean evidence and a clear severity call.

This workflow runs static scans for JavaScript, PHP, or Python, then saves a client-ready HTML report to Google Drive. You’ll see what it automates, what you get out of it, and how to make it fit your own pipeline.

How This Automation Works

The full n8n workflow, from trigger to final output:

n8n Workflow Template: OpenAI + Google Drive, shareable code scan reports

The Problem: Code scan results are hard to ship

Static analysis is supposed to be the “quick pass.” In reality, the scan is only half the job. The other half is turning raw findings into something structured, credible, and shareable. You end up reformatting output, hunting for the exact line numbers again, and rewriting the same severity explanations in slightly different words. One small mistake (wrong file URL, missing snippet, vague severity) and your report gets questioned, which means more back-and-forth and less time finding real issues.

The friction compounds. Here’s where it breaks down in day-to-day work.

  • Findings get scattered across tools, so the “final report” becomes a manual assembly project.
  • You spend about 1–2 hours per target just cleaning output and adding basic context.
  • Small formatting inconsistencies make results look less trustworthy, even when the vulnerability is real.
  • Sharing is awkward because raw logs don’t travel well, and screenshots don’t scale.

The Solution: AI-assisted static scans that publish clean HTML reports

This n8n workflow takes a code target, runs static security analysis with OpenAI-based agents, then produces a structured report you can send without apologizing for the formatting. It starts from a simple input form, where you choose the language analyzer (JavaScript, PHP, or Python) and provide the target details. For the selected language, the workflow fetches the relevant files (or URLs) using HTTP requests, then hands the content to a specialized AI “security agent” that looks for exploitable vulnerabilities using AST and regex-style heuristics. After that, it cleans and validates the returned JSON, builds a styled HTML table grouped by severity, and stores the finished HTML report in Google Drive.

The workflow begins with a form trigger, then routes you down the correct language branch. The agent produces strict JSON findings, n8n post-processes them, and Google Drive becomes your single place to grab the final client-ready report.

What You Get: Automation vs. Results

Example: What This Looks Like

Say you review three small repos in a week (one JavaScript, one PHP, one Python). Manually, you might spend about 45 minutes per repo collecting snippets, rewriting into a table, and packaging it for sharing, so roughly 2–3 hours total. With this workflow, you submit each target in the form (a couple minutes), wait for analysis and HTML generation (often around 5–10 minutes), and then grab the finished report from Google Drive. That is usually a couple hours back per week, with reports that look consistent from the first run.

What You’ll Need

  • n8n instance (try n8n Cloud free)
  • Self-hosting option if you prefer (Hostinger works well)
  • OpenAI for AI-assisted vulnerability analysis
  • Google Drive to store shareable HTML reports
  • OpenAI API key (get it from your OpenAI dashboard)

Skill level: Intermediate. You’ll connect credentials, paste in keys, and verify a couple requests, but you won’t be writing a full app.

Don’t want to set this up yourself? Talk to an automation expert (free 15-minute consultation).

How It Works

You submit a target and pick a language analyzer. The workflow starts with an n8n form trigger. You choose JavaScript, PHP, or Python so the workflow routes your request to the right analysis branch.

Code is fetched from the source you provide. Each branch uses HTTP requests to pull file contents or URLs into the workflow. This keeps the evidence chain cleaner, because findings can reference the exact file path or URL they came from.

OpenAI agents generate exploitable findings in strict JSON. A language-specific security agent runs, backed by an OpenAI chat model tuned for that language. The response is constrained to a predictable JSON shape (URL, snippet, severity, vulnerability type), so it is usable downstream.

Results are cleaned, formatted, and published to Google Drive. n8n splits findings, drops empty items, then builds a styled HTML table and composes the final report. The last step stores that HTML file in Google Drive so you can share it with a link or attach it to a client email.

You can easily modify the severity rules to match your internal rubric based on your needs. See the full implementation guide below for customization options.

Step-by-Step Implementation Guide

Step 1: Configure the Form Trigger

Set up the user input form that starts the workflow and collects the target file URL plus analyzer choice.

  1. Add and open Input Form Trigger.
  2. Set Form Title to AI-Powered Code Analyzer.
  3. Set Form Description to Only one option can be selected from the three: (GitHub Repository, Domain To Crawl, Single File URL)..
  4. In Form Fields, include a text field labeled Single File URL with placeholder https://example.com/path/file.js.
  5. Add a checkbox field labeled AI-Powered Code Analyzer with options AI JavaScript Expert, AI PHP Expert, and AI Python Expert, and mark it as required.

Tip: Only one analyzer should be selected, because the routing nodes look for a single matching option in AI-Powered Code Analyzer.

Step 2: Split and Route the Analyzer Choice

Split the selected analyzer and route it to the correct language branch.

  1. Configure Split Analyzer Choice with Field To Split Out set to ["AI-Powered Code Analyzer"].
  2. In Route JS Choice, set the rule to compare Left Value ={{ $json["[\"AI-Powered Code Analyzer\"]"] }} with Right Value AI JavaScript Expert.
  3. In Route PHP Choice, set the rule to compare Left Value ={{ $json["[\"AI-Powered Code Analyzer\"]"] }} with Right Value AI PHP Expert.
  4. In Route Python Choice, set the rule to compare Left Value ={{ $json["[\"AI-Powered Code Analyzer\"]"] }} with Right Value AI Python Expert.

Split Analyzer Choice outputs to both Route Python Choice, Route PHP Choice, and Route JS Choice in parallel.

⚠️ Common Pitfall: If the checkbox label or option text is changed, update the switch rules to match exactly or the routing will not trigger.

Step 3: Set Up the AI Security Agents and Models

Each branch uses a language-specific model and agent; the HTTP fetch tools are attached to the agents.

  1. Open OpenAI JS Model and select model gpt-4.1-mini. Credential Required: Connect your openAiApi credentials.
  2. Open OpenAI PHP Model and select model gpt-4.1-mini. Credential Required: Connect your openAiApi credentials.
  3. Open OpenAI Python Model and select model gpt-4.1-mini. Credential Required: Connect your openAiApi credentials.
  4. In JS Security Agent, set Text to ={{ $('Input Form Trigger').item.json['Single File URL'] }} and keep Prompt Type as define. Ensure OpenAI JS Model is connected as the language model for JS Security Agent.
  5. In PHP Security Agent, set Text to ={{ $('Input Form Trigger').item.json['Single File URL'] }} and keep Prompt Type as define. Ensure OpenAI PHP Model is connected as the language model for PHP Security Agent.
  6. In Python Security Agent, set Text to ={{ $('Input Form Trigger').item.json['Single File URL'] }} and keep Prompt Type as define. Ensure OpenAI Python Model is connected as the language model for Python Security Agent.
  7. For each HTTP tool (JS File Fetch, PHP File Fetch, Python File Fetch), set URL to ={{ $('Input Form Trigger').item.json['Single File URL'] }} and keep Timeout at 20000.

Tip: JS File Fetch, PHP File Fetch, and Python File Fetch are AI tools. If they require credentials in your environment, add them to the parent nodes: JS Security Agent, PHP Security Agent, and Python Security Agent.

Step 4: Normalize and Filter the AI Results

Parse the model outputs into JSON, split findings, and remove empty results before report generation.

  1. In Format JS Results, keep the provided JavaScript Code as-is to normalize output JSON.
  2. In Format PHP Results and Format Python Results, keep the same parsing logic to handle string-wrapped JSON outputs.
  3. Configure Split JS Findings, Split PHP Findings, and Split Python Findings with Field To Split Out set to results.
  4. In Filter JS Blanks, Filter PHP Blanks, and Filter Python Blanks, ensure the condition checks Left Value ={{ $json.url }} with operator exists.

⚠️ Common Pitfall: If the AI returns invalid JSON, the parsing nodes will output an error object. Validate your system prompts if you see Invalid JSON input.

Step 5: Build HTML Reports

Convert findings to HTML tables and wrap them in a styled HTML template for each language branch.

  1. Set Build JS HTML Table, Build PHP HTML Table, and Build Python HTML Table to Operation convertToHtmlTable.
  2. In Compose JS HTML, Compose PHP HTML, and Compose Python HTML, keep the HTML template and ensure it injects the table using {{ $json.table }}.

Tip: All three Compose nodes include responsive table CSS; keep the template intact to avoid formatting issues in the stored reports.

Step 6: Configure Google Drive Report Storage

Save each HTML report to Google Drive with a timestamped filename.

  1. Open Store JS HTML Report and set Operation to createFromText, Content to ={{ $json.html }}, and keep the dynamic Name expression =JavaScript Single URL {{ (() => {const d=new Date();return `${String(d.getDate()).padStart(2,'0')}-${String(d.getMonth()+1).padStart(2,'0')}-${d.getFullYear()} (${String(d.getHours()).padStart(2,'0')}:${String(d.getMinutes()).padStart(2,'0')})`;})() }}.html. Credential Required: Connect your googleDriveOAuth2Api credentials.
  2. Open Store PHP HTML Report and set Operation to createFromText, Content to ={{ $json.html }}, and keep the dynamic Name expression =PHP Single URL {{ (() => {const d=new Date();return `${String(d.getDate()).padStart(2,'0')}-${String(d.getMonth()+1).padStart(2,'0')}-${d.getFullYear()} (${String(d.getHours()).padStart(2,'0')}:${String(d.getMinutes()).padStart(2,'0')})`;})() }}.html. Credential Required: Connect your googleDriveOAuth2Api credentials.
  3. Open Store Python HTML Report and set Operation to createFromText, Content to ={{ $json.html }}, and keep the dynamic Name expression =Python Single URL {{ (() => {const d=new Date();return `${String(d.getDate()).padStart(2,'0')}-${String(d.getMonth()+1).padStart(2,'0')}-${d.getFullYear()} (${String(d.getHours()).padStart(2,'0')}:${String(d.getMinutes()).padStart(2,'0')})`;})() }}.html. Credential Required: Connect your googleDriveOAuth2Api credentials.

Tip: The default Drive is My Drive and Folder is / (Root folder). Adjust if you want reports stored elsewhere.

Step 7: Test and Activate Your Workflow

Validate each branch with real inputs, confirm report generation, and enable the workflow.

  1. Click Execute Workflow and submit the form in Input Form Trigger with a valid Single File URL and one analyzer option.
  2. Confirm the flow runs through the correct branch (JS, PHP, or Python) and that Format Results → Split Findings → Filter Blanks nodes produce items.
  3. Verify the HTML output is created in the corresponding Store JS HTML Report, Store PHP HTML Report, or Store Python HTML Report node and appears in Google Drive.
  4. If all outputs look correct, switch the workflow to Active so users can submit audits via the form.
🔒

Unlock Full Step-by-Step Guide

Get the complete implementation guide + downloadable template

Common Gotchas

  • Google Drive credentials can expire or need specific permissions. If things break, check the connected Google account access and the n8n credential status first.
  • If you’re using Wait nodes or external rendering, processing times vary. Bump up the wait duration if downstream nodes fail on empty responses.
  • Default prompts in AI nodes are generic. Add your brand voice early or you’ll be editing outputs forever.

Related Workflows

If you’re doing code reviews and also triaging suspicious domains, urlscan.io to Gmail, clear risk verdicts in your inbox pairs nicely because it gives you a quick “safe vs risky” verdict without opening a dozen tabs.

For teams that start investigations from a single URL and need a quick sanity check before digging deeper, OpenAI + SerpAPI: scam risk scores from one URL helps you score what you’re looking at, then you can prioritize which code or assets deserve a closer security pass.

When you want a lighter-weight email summary for link scans (less “verdict,” more context), urlscan.io to Gmail, clean link scan summaries is useful alongside this workflow since both aim to produce something you can forward as-is.

Need a more formal attachment for stakeholders who love PDFs? SerpAPI to Gmail, domain recon PDF reports complements your Google Drive HTML reports when you want a locked-in deliverable for compliance or client portals.

Finally, if your security process starts in chat, Telegram + VirusTotal: safer links before you click fits well because it reduces risky clicks before you even get to deeper analysis and reporting.


Quick reference:

Frequently Asked Questions

How long does it take to set up this OpenAI Drive reports automation?

About 30 minutes if you already have your API keys ready.

Do I need coding skills to automate shareable code scan reports?

No. You’ll mostly connect credentials and edit a couple fields. If you can follow a checklist, you’re fine.

Is n8n free to use for this OpenAI Drive reports workflow?

Yes. n8n has a free self-hosted option and a free trial on n8n Cloud. Cloud plans start at $20/month for higher volume. You’ll also need to factor in OpenAI API usage costs (often a few dollars a month for light scanning).

Where can I host n8n to run this automation?

Two options: n8n Cloud (managed, easiest setup) or self-hosting on a VPS. For self-hosting, Hostinger VPS is affordable and handles n8n well. Self-hosting gives you unlimited executions but requires basic server management.

Can I customize this OpenAI Drive reports workflow for GitHub repos instead of file URLs?

Yes, but you’ll swap the HTTP Request “file fetch” part to pull from GitHub’s API (or your repo source) before the JS/PHP/Python Security Agent runs. Common customizations include changing the input form fields, adding repo authentication, and adjusting the HTML template to match your client branding. If you keep the JSON schema the same, the formatting and Google Drive storage steps usually stay untouched.

Why is my Google Drive connection failing in this workflow?

Usually it’s an expired Google authorization or the connected account lost permission to write to the destination folder. Reconnect the Google Drive credential in n8n and confirm the folder location is still accessible. If you’re in a workspace, admin restrictions can also block file creation.

How many files can this OpenAI Drive reports automation handle?

It depends on your n8n plan and how many files you feed it per run, but most small codebases are fine.

Is this OpenAI Drive reports automation better than using Zapier or Make?

For this use case, n8n is usually the better fit because it can handle branching (JS vs PHP vs Python) and structured post-processing without turning into a fragile chain of zaps. Self-hosting also matters if you’re scanning often, since you’re not paying per task in the same way. Zapier and Make can work, but multi-step formatting (split, filter blanks, compose HTML, store) gets tedious fast. n8n’s AI Agent style flow is also easier to keep consistent once you’ve tuned prompts. Talk to an automation expert if you want help deciding.

Clean findings, consistent severity, and a Google Drive report you can share immediately. Set it up once, then stop rebuilding the same deliverable every time you scan.

Need Help Setting This Up?

Our automation experts can build and customize this workflow for your specific needs. Free 15-minute consultation—no commitment required.

Talk to Automation Expert →

Lisa Granqvist

Workflow Automation Expert

Expert in workflow automation and no-code tools.

×

Use template

Get instant access to this n8n workflow Json file

Copy and import json workflow into your n8n workflow

💬