The Problem
Cyber investigators need a self‑hosted, graph‑oriented UI that can ingest OSINT enrichers without sending data to third‑party SaaS platforms. Existing tools are either closed‑source or require complex manual wiring of back‑end services, making rapid deployment and data‑privacy difficult.
What This Does
flowsint delivers a full‑stack solution: a FastAPI back‑end (flowsint‑api/app/main.py) that exposes REST endpoints for investigations, enrichers, and chat, and a React‑based front‑end (flowsint‑app/src/) that renders an interactive graph and editor. The back‑end stores data via SQLAlchemy migrations (flowsint‑api/alembic/versions/.py) and enforces permissions in flowsint‑api/app/security/permissions.py. Enricher logic lives in the API routes such as flowsint‑api/app/api/routes/enrichers.py and the corresponding Pydantic schemas (flowsint‑api/app/api/schemas/enricher.py). The front‑end consumes these APIs through typed services (e.g., src/api/enricher-service.ts) and visualises results with a rich set of SVG icons.
How To Use It
Setup
git clone https://github.com/reconurge/flowsint.git cd flowsint Install Docker and Make (required by README) make prod # defined in the repository Makefile
make prod builds the production Docker images defined in flowsint-api/Dockerfile and flowsint-app/Dockerfile, then launches them via docker-compose.yml (which references the same files).
Configuration
Copy the example environment file and fill in any secrets required by the API (e.g., JWT secret, DB URL): cp .env.example .env edit .env as needed
The API reads its settings from this file (flowsint‑api/app/utils.py pulls os.getenv values). No other config files are referenced in the source tree.
Running
After make prod completes, Docker Compose starts two containers: API: reachable at http://localhost:8000 (FastAPI auto‑docs at /docs). Entry point is flowsint‑api/app/main.py. Front‑end: served by Nginx on http://localhost:5173 (static entry point flowsint‑app/index.html).
Open a browser to http://localhost:5173/register to create a local account and begin investigations.
Real‑World Use
A SOC analyst can script a nightly job that calls the API’s /enrichers/domain endpoint (see flowsint‑api/app/api/routes/enrichers.py) to enrich newly discovered domains, store results in the internal PostgreSQL database, and then visualise relationships in the web UI. Example Python snippet:
import requests, os
BASE = os.getenv("APIURL", "http://localhost:8000")
token = requests.post(f"{BASE}/auth/login", json={"username":"admin","password":"pwd"}).json()["accesstoken"] headers = {"Authorization": f"Bearer {token}"} resp = requests.post(f"{BASE}/enrichers/domain", json={"domain":"example.com"}, headers=headers) print(resp.json())
Code Health & Issues
Low – Missing test suite – No tests/ directory; CI workflow (.github/workflows/images.yml) only builds Docker images, not unit/integration tests. Low – Python lockfile absent – pyproject.toml declares dependencies but no poetry.lock or requirements.txt, making reproducible builds harder. Low – Front‑end lockfile missing – package.json is present but there is no package-lock.json/pnpm-lock.yaml/yarn.lock. Low – Minimal CI validation – Only image‑build step; no linting, type‑checking, or security scanning configured. Low – Secrets handling – .env.example is provided, but the repo contains no guidance on rotating JWT secrets or DB passwords; developers must ensure they are not committed. Low – Documentation gaps – README covers basic start‑up, yet no API usage guide; the flowsint‑api/README.md is minimal.
No high‑severity bugs are evident from static inspection; the code follows standard FastAPI and React patterns, and migrations are version‑controlled.
The Bottom Line
flowsint offers a ready‑to‑run, containerised OSINT graph platform with a clear separation between API and UI. It is suitable for teams that can tolerate the current lack of automated tests and lockfiles, and that value full data control. For production deployments, add a test suite, lockfiles, and CI security checks before scaling.