April 26, 2026 4 min read JSX fork

Shuffle

Abstract

Shuffle: A general purpose security automation platform. Our focus is on collaboration and resource sharing.

The Problem Security‑orchestration teams need a shared, extensible automation console that can be self‑hosted without re‑inventing the underlying workflow engine. Existing SOAR tools are often closed, hard to extend, or require heavyweight infrastructure.

What This Does Shuffle provides a web UI (React) and a Go‑based backend that together expose a workflow editor, app marketplace, and API gateway. The UI lives under frontend/ (entry point frontend/src/index.js → frontend/src/App.jsx). The server starts from backend/go-app/main.go, reads configuration from .env, and talks to an OpenSearch instance defined in backend/database/opensearch/docker-compose.yml. Dockerfiles (backend/Dockerfile, frontend/Dockerfile) and a top‑level docker‑compose.yml orchestrate the whole stack.

How It Is Wired

Component	Responsibility	Key imports / calls
`backend/go-app/main.go`	Starts the HTTP API, loads env vars, registers routes	imports `backend/go-app/docker.go`, `backend/go-app/walkoff.go`
`backend/go-app/docker.go`	Wraps Docker client for app execution	calls `github.com/docker/docker/client` (pinned v28.3.3)
`frontend/src/App.jsx`	Root React component, mounts router and context providers	imports `frontend/src/theme.jsx` (hub, 111 dependents) and `frontend/src/context/ContextApi.jsx` (hub, 67 dependents)
`frontend/src/theme.jsx`	Supplies MUI theme; heavily imported, low churn	no outbound imports (instability 0)
`frontend/src/context/ContextApi.jsx`	Global state, used by most UI parts	no outbound imports (instability 0)
`frontend/src/views/Workflows2.jsx`	Workflow editor UI – oversized (5 449 lines) and deepest nesting (22)	participates in import cycle with `WorkflowTemplatePopup.jsx` and `WorkflowValidationTimeline.jsx`
`backend/app_gen/python‑lib/baseline`	Example Python app generator, built into Docker image	invoked by CI for testing app generation

The import graph shows 177 internal modules with 7 circular dependencies; the most volatile hub is frontend/src/theme.jsx. The workflow editor (Workflows2.jsx) sits in a cycle, increasing blast radius for any change.

How To Use It

# Clone the repo
git clone https://github.com/moses-y/Shuffle
cd Shuffle

# Install UI deps
cd frontend && npm ci && cd ..

# Build Go backend
cd backend/go-app && go build -o shuffle && cd ..

# Bring up the stack (OpenSearch + UI + API)
docker compose up -d

Configuration – copy .env.example (not present, create one) and set at minimum:

SHUFFLE_DOWNLOAD_WORKFLOW_PASSWORD=…
SHUFFLE_OPENSEARCH_PASSWORD=…
OPENSEARCH_INITIAL_ADMIN_PASSWORD=…

Run – the API is reachable at http://localhost:8080, UI at http://localhost:3000. For development, start the UI with npm start inside frontend/ and the backend with go run ./backend/go-app/main.go.

Real‑World Use A SOC can deploy Shuffle on‑premises, register its existing Splunk and TheHive instances as “apps” via the OpenAPI app generator, then author a workflow that triggers a phishing‑email enrichment pipeline: the UI creates the workflow, the backend spins a Docker container for the enrichment app, stores results in OpenSearch, and posts a Slack notification—all within a single end‑to‑end run.

Code Health & Issues

Measured static findings

High – Hub module: frontend/src/theme.jsx (111 dependents). Keep it tiny.
High – Deep nesting: frontend/src/views/Workflows2.jsx (max depth 22). Refactor to early returns.
High – Oversized file: frontend/src/views/Workflows2.jsx (5 449 lines). Split by responsibility.
Medium – Empty catch: frontend/src/views/Workflows2.jsx & frontend/src/components/ShuffleCodeEditor1.jsx. Add logging or rethrow.
High – Import cycle: frontend/src/views/Workflows2.jsx ↔ WorkflowTemplatePopup.jsx ↔ WorkflowValidationTimeline.jsx. Break the cycle.

Code‑health audit

Critical – Vulnerable Go deps (golang.org/x/crypto@0.45.0, google.golang.org/grpc@1.72.2). Upgrade.
Critical – Committed credentials in .env. Rotate and remove from repo.
Critical – Secrets in .github/workflows/quick-testing.yml. Move to workflow_run or gated environment.
High – Unpinned GitHub Actions (docker/setup-buildx-action@v3). Pin to SHA.
High – Additional vulnerable Go packages (e.g., github.com/go-jose/go-jose/v4@4.1.3). Upgrade.
High – Docker Compose uses privileged mode and host networking. Limit capabilities and publish ports explicitly.
High – .env tracked in Git. Remove, add to .gitignore, provide example file.
High – CI never runs tests. Add a test step to existing workflows.
Medium – GITHUB_TOKEN permissions not scoped. Declare least‑privilege (contents: read).
Medium – Base images in backend/Dockerfile use mutable tags (golang:1.24, alpine:latest). Pin by digest.

The Bottom Line Shuffle is a functional, container‑ready SOAR platform with a clear UI/backend split, but the codebase suffers from large, tightly coupled UI modules, several import cycles, and serious secret‑management lapses. It is suitable for teams comfortable tightening the CI pipeline, rotating credentials, and refactoring the workflow editor before extending it in production.

What the analyser found

Deployment readiness

6/7

Container image
CI pipeline
Lockfile committed
Test suite
README
License
No committed secrets

Composition

463 files

JSX161
YAML64
Shell35
Markdown19
JavaScript13
Go6

ReactExpressDockerKubernetes

Module dependencies

The 10 most depended-upon modules of 177, from static import analysis. Red outline marks a module in an import cycle.

graph LR n0_frontend_src_theme["theme"] n1_ntend_src_context_ContextApi["ContextApi"] n2_rontend_src_views_Workflows2["Workflows2"] n3__src_components_AppFramework["AppFramework"] n4_frontend_src_views_Docs["Docs"] n5_nd_src_components_Oauth2Auth["Oauth2Auth"] n6_tend_src_components_Dropzone["Dropzone"] n7_rc_components_PaperComponent["PaperComponent"] n8_d_src_components_ScrollToTop["ScrollToTop"] n9_frontend_src_views_Apps["Apps"] n5_nd_src_components_Oauth2Auth --> n1_ntend_src_context_ContextApi n5_nd_src_components_Oauth2Auth --> n0_frontend_src_theme n9_frontend_src_views_Apps --> n0_frontend_src_theme n9_frontend_src_views_Apps --> n1_ntend_src_context_ContextApi n9_frontend_src_views_Apps --> n6_tend_src_components_Dropzone n4_frontend_src_views_Docs --> n0_frontend_src_theme n4_frontend_src_views_Docs --> n2_rontend_src_views_Workflows2 n4_frontend_src_views_Docs --> n1_ntend_src_context_ContextApi n2_rontend_src_views_Workflows2 --> n0_frontend_src_theme n2_rontend_src_views_Workflows2 --> n1_ntend_src_context_ContextApi n2_rontend_src_views_Workflows2 --> n6_tend_src_components_Dropzone n2_rontend_src_views_Workflows2 --> n8_d_src_components_ScrollToTop classDef cyc stroke:#ef4444,stroke-width:2px; class n2_rontend_src_views_Workflows2 cyc;

Dependencies

122 declared dependencies, none a major version behind. Resolved 2 of 122 against the registry.

Findings

LowSecret-shaped paths present; the code-health audit confirms or clears them .env, frontend/certs/fullchain.pem, frontend/certs/privkey.pem

Open in Code Brain → See its neighbourhood →

What would stop me shipping this

Ranked by severity × confidence × production reach. Reach is the honest discriminator across a collection that is mostly other people's code: the same finding matters more in something that ships.

critical3

high5

medium6

low2

Upgrade the pinned dependency carrying a critical advisorycritical31 occurrences

golang.org/x/crypto@0.45.0 CVE-2026-42508 (critical) +26 more; google.golang.org/grpc@1.72.2 CVE-2026-33186 (critical) +3 more

The manifest pins the exact version the advisory covers, so this is not a warning about drift: the vulnerable code is what installs, and a critical rating means it is reachable over the network without credentials or user interaction.

Fix: Upgrade to the fixed version named in the advisory, then commit the lockfile.

Rotate the credentials in the committed environment filecritical3 occurrences

.env

SHUFFLE_DOWNLOAD_WORKFLOW_PASSWORD, SHUFFLE_OPENSEARCH_PASSWORD, OPENSEARCH_INITIAL_ADMIN_PASSWORD hold generated values

These values are loaded by the application at boot, so a generated value here is a working credential for something that runs.

Fix: Rotate each named credential, remove the file from the index, and replace it with a keys-only example.

Keep secrets out of workflows a fork can triggercritical4 occurrences

.github/workflows/quick-testing.yml

TWILIO_ACCOUNT_SID, TWILIO_TO_NUMBER, TWILIO_FROM_NUMBER, TWILIO_AUTH_TOKEN (publish or cloud scope)

Contributor-controlled input reaches a job holding a publish token or cloud credential, so a pull request becomes credential exfiltration.

Fix: Move secret-using steps into a workflow_run job that never checks out pull request code, or gate on an environment with required reviewers.

Pin third-party GitHub Actions to a commit SHAhigh6 occurrences

.github/workflows

docker/setup-buildx-action@v3, docker/setup-qemu-action@v3, docker/login-action@v3, docker/build-push-action@v4

A tag can be moved, so the action running with your token and secrets is whatever its owner last pushed; this is how tj-actions/changed-files leaked secrets from thousands of repos.

Fix: Replace each @vN with the 40-character commit SHA, keep # vN as a comment, and let Dependabot bump the SHAs.

Upgrade the pinned dependency carrying a published advisoryhigh35 occurrences

github.com/go-jose/go-jose/v4@4.1.3 CVE-2026-34986 (high) +1 more; github.com/docker/docker@28.3.3+incompatible CVE-2026-42306 (high) +9 more; github.com/go-git/go-billy/v5@5.6.2 CVE-2026-44973 (high) +3 more; github.com/go-git/go-git/v5@5.16.5 CVE-2026-45022 (high) +17 more; and 1 more package(s)

The pinned version is the one that installs, so a published advisory against it describes this deployment rather than a hypothetical one, and the advisory is also a public description of how to exploit it.

Fix: Upgrade to the fixed version named in the advisory, then commit the lockfile.

Drop privileged mode and host networkinghigh2 occurrences

docker-compose.yml

the docker socket mounted

privileged hands the container every capability including direct device access, which makes escaping to the host a documented one-liner, and host networking removes the network boundary so every port the container opens is open on the host.

Fix: Grant the specific capability the workload needs with cap_add, and publish ports explicitly.

Remove the committed .env and rotate what it holdshigh

.env

A tracked .env is the most common route for a working key to reach a public clone, and it is the file the app actually loads, so the value is usually live.

Fix: git rm --cached the file, add it to .gitignore, rotate every credential it names, commit a .env.example with empty values.

Make CI invoke the test suite it hashigh29 occurrences

.github/workflows

29 test files, no test command in the 4 workflows read

A green check that never executed an assertion is worse than no check, because reviewers trust it.

Fix: Add a test step to the existing workflow rather than a new workflow.

Declare least-privilege permissions for GITHUB_TOKENmedium3 occurrences

.github/workflows/dockerbuild-nightly.yaml

3 workflow(s) declare no permissions, 3 of them reference secrets

With no declaration the token inherits the repository default, so any injected step can push commits or mint releases from inside your own CI.

Fix: Add permissions: contents: read at the top of the workflow and widen per job only where needed.

Pin the container base image by digestmedium3 occurrences

backend/Dockerfile

golang:1.24, alpine:latest, alpine:3.22.2 (mutable tag)

An untagged or mutable base means today's build and last month's contain different libc and a different CVE set, with no record of which shipped.

Fix: Use image:tag@sha256:<digest> and enable Dependabot's docker ecosystem.

Gate pull requests on a dependency vulnerability scanmedium

.github/workflows

no dependency scan in CI

This is the one gate that would catch a known-vulnerable package before it reaches a build, and no repository in the sample had it.

Fix: Add dependency-review-action on pull_request, or osv-scanner on push and a schedule.

Add a pre-commit secret gatemedium

a secret-shaped file is tracked and no repo-level gate is visible

Without a gate the same class of leak recurs on the next commit, so a leak finding is the symptom and this is the cause.

Fix: Add a pre-commit hook scanning staged content, and enable push protection.

4 further finding(s) are listed in the full report.

Checked deterministically against the repository tree and a bounded set of its files: committed credentials, unpinned actions and base images, missing lockfiles and update bots, workflows that discard failures, published advisories against the declared dependencies, runtime configuration, licensing and notebook reproducibility. No language model is involved in this section.

View on GitHub All Projects