The Problem
Security operations teams struggle to orchestrate tools across disconnected systems. Shuffle addresses this by providing a SOAR (Security Orchestration, Automation, and Response) platform that lets analysts build automated workflows connecting their existing security stack—SIEMs, threat intel feeds, ticketing systems, and custom tools—without writing glue code for every integration.
What This Does
Shuffle is a full-stack automation platform with a React frontend (frontend/src/App.jsx) and a Go-based backend (backend/go-app/main.go). The frontend provides a drag-and-drop workflow editor, while the backend handles workflow execution, app integration, and API endpoints. The repo includes Docker configuration (docker-compose.yml, backend/Dockerfile, frontend/Dockerfile) for containerized deployment, plus OpenSearch for data storage (backend/database/opensearch/docker-compose.yml).
The platform supports app creation via OpenAPI definitions and Python libraries (backend/app_gen/python-lib/), enabling users to build custom integrations. Test coverage exists across both frontend (frontend/src/test/) and backend (backend/tests/) with 37 test files, suggesting a maturing codebase.
How To Use It
Setup: The repo provides Docker Compose for orchestrated deployment. From the root directory, run:
docker-compose up -d
For local development, the backend Go app can be run directly from backend/go-app/ after installing dependencies from go.mod. The frontend uses npm (frontend/package.json).
Configuration: The .env file at the root contains environment variables, though its contents are not documented in the repo. The docker-compose.yml defines service configuration including OpenSearch and the backend/frontend containers. TLS certificates exist in frontend/certs/ for HTTPS termination.
Running it: After containers are up, the frontend serves on port 80/443 and the backend API on its configured port. The README points to a detailed installation guide at .github/install-guide.md for production deployments, including Kubernetes via Helm charts (.github/workflows/helm-release.yml).
Real-World Use
A security operations center uses Shuffle to automate phishing triage. An analyst configures a workflow that: Receives an email via webhook trigger Extracts indicators and queries VirusTotal (via OpenAPI app) Creates a ticket in TheHive (via Python app) Enriches with MISP data Routes to the appropriate analyst based on severity
This replaces manual copy-paste between tools, reducing response time from minutes to seconds.
Code Health & Issues
High - Potential secrets exposure: frontend/certs/privkey.pem and fullchain.pem are committed, plus a .env file. These should be gitignored and rotated if this is a public fork. Med - Mixed language complexity: The repo spans Go, JavaScript, Python, and Shell. This adds operational overhead for maintenance and debugging across the stack. Med - Test coverage gaps: While 37 test files exist, the breadth is unclear—backend/tests/ contains mostly shell scripts (e.g., workflows.sh, users.sh) suggesting integration tests, not unit tests. Core logic in backend/go-app/main.go has only one test file. Low - Documentation fragmentation: Installation docs exist in Markdown and HTML formats (.github/install-guide.md, .github/install-guide.html), risking inconsistency. The primary docs live in a separate repository (shuffle-docs).
The Bottom Line
Shuffle is a legitimate SOAR platform with active development and a real community, evidenced by its 2,410-star upstream repo and Discord channel. The architecture is sound—Go backend for performance, React frontend for UX, Docker for deployment. It's best suited for security teams wanting an open-source alternative to commercial SOAR tools, though the mixed-language codebase and committed secrets warrant caution before production adoption. Teams should review the security findings and consider using the hosted version at shuffler.io if self-hosting isn't a core requirement.