I sell a small pack of n8n workflows built around one idea: automation should ship with its own acceptance tests, and sends should stay disabled until those tests pass. Before listing it, I did the only honest thing you can do with a claim like that — I ran my own tests against my own product on a live n8n instance. They failed. Twice. This is the story, because both bugs are ones your workflows probably have too.
Bug 1: require('crypto') doesn't exist where you think it does
My intake workflow deduplicates submissions with a hash key. Locally-authored, looked clean, "obviously worked." On a stock n8n install it died instantly:
Module 'crypto' is disallowed
n8n's Code node sandboxes away Node builtins by default. If your dedupe, signing, or ID logic uses require('crypto'), it works on your tweaked dev instance and breaks on your client's stock one. Fix: a pure-JS hash (I used double FNV-1a — dedupe keys don't need cryptographic strength) or enabling builtin access consciously via env config — as a documented decision, not an accident.
