Read 2026-10-04
appflowy-io/appflowy: technical due diligence, read from its repository
What Borehole read in appflowy-io/appflowy's code and history at 5cf3a36: its licence, security advisories, releases, review practice, tests, dependencies and operations. Every finding cites the file and line it rests on. The full report also covers the team and asks the questions the code cannot answer.
| Dimension | Rating |
|---|---|
| Architecture & Codebase — including AI provenance | strong |
| Engineering Process & SDLC Maturity | strong |
| Product & Engineering Maturity | strong |
| Security & Reliability Posture | adequate |
| Observability & Operations | not assessable |
| Fit with the Acquirer | not assessable |
What the repository says
LICENSE: Relicensed: Apache-2.0 → AGPL-3.0 (2021-11-09)
Architecture & Codebase — including AI provenance
strongfrontend/appflowy_flutter/lib/workspace/presentation/settings/widgets/emoji_picker/src/emoji_lists.dart is 3,224 lines, 37× this codebase's median file
adequateThe median source file here is 85 lines. 16 files exceed 1,000 lines, the largest being 3,224. Size is not a defect on its own — some problems genuinely live in one place — but these are where merge conflicts, review fatigue and single-owner knowledge concentrate, and they are the first thing that slows an inheriting engineer down.
frontend/appflowy_flutter/lib/workspace/presentation/settings/widgets/emoji_picker/src/emoji_lists.dart:1 — 3,224 lines (37× median) |
frontend/rust-lib/flowy-folder/src/manager.rs:1 — 2,638 lines (31× median) |
frontend/rust-lib/flowy-database2/src/services/database/database_editor.rs:1 — 2,465 lines (29× median) |
frontend/appflowy_flutter/lib/shared/popup_menu/appflowy_popup_menu.dart:1 — 1,668 lines (19× median) |
frontend/rust-lib/flowy-database2/src/event_handler.rs:1 — 1,451 lines (17× median) |
Engineering Process & SDLC Maturity
strongNo finding.
Product & Engineering Maturity
strongNo finding.
Security & Reliability Posture
adequateNone of the standard security guard rails are configured
adequateThere is no disclosure policy, no automated dependency updates, no named code owners and no pre-commit configuration. None of these is load-bearing on its own. Their collective absence says that security posture here is whatever the current team happens to remember to do, which is not a posture that survives the team changing.
| checked 5 kinds of guard rail across 4,597 tracked files; 0 present |
1 environment file is committed
adequatefrontend/rust-lib/flowy-sqlite/.env is tracked in git. Environment files are where credentials usually live, and committing one usually means nobody decided how secrets reach the running application. Whatever is in it is in the history for good. Check 05.1 says whether it holds anything credential-shaped.
frontend/rust-lib/flowy-sqlite/.env — committed environment file |
The build runs third-party code it does not pin
adequate19 third-party CI actions are referenced by a tag or branch rather than a commit, so they run whatever that tag points to on the day; 3 steps pipe a download straight into a shell. Tags have been moved to malicious commits in real supply-chain attacks, and a piped script is whatever the server returns that minute. Pinning to a commit is the fix, and it is small.
.github/workflows/commit_lint.yml:11 — action pinned by tag |
.github/workflows/docker_ci.yml:23 — action pinned by tag |
frontend/scripts/docker-buildfiles/Dockerfile:23 — download piped into a shell |
53 locked dependencies have published vulnerabilities, 13 high or critical
adequate53 of 799 locked dependencies match 77 published advisories in OSV, 13 of them rated high or critical. A lockfile says which version is installed, not whether the flawed code is reachable from this product, so each needs a look. Most are fixed by an upgrade, and the advisory names the version. This lockfile pins development tools alongside what ships and does not say which is which, so some of these may never reach a user.
frontend/rust-lib/Cargo.lock — diesel 2.2.10: GHSA-h5x4-m2qf-r4f2 (high), fixed in 2.3.8 |
frontend/rust-lib/Cargo.lock — lz4_flex 0.11.2: GHSA-vvp9-7p8x-rfvv (high), fixed in 0.11.6 |
frontend/rust-lib/Cargo.lock — mio 0.8.9: GHSA-r8w9-5wcg-vfj7 (high), fixed in 0.8.11 |
The app allows plain HTTP to any server
adequateThe app's manifest allows unencrypted HTTP app-wide (NSAllowsArbitraryLoads, or cleartext traffic permitted), rather than for named domains. Anything sent over plain HTTP can be read on the network, and enterprise security reviews ask about it. Some apps need it by nature (a podcast or feed reader fetches whatever URL a feed gives), so ask which case this is.
frontend/appflowy_flutter/ios/Runner/Info.plist:46 — cleartext allowed app-wide |
frontend/appflowy_flutter/macos/Runner/Info.plist:47 — cleartext allowed app-wide |
Relicensed: Apache-2.0 → AGPL-3.0 (2021-11-09)
adequateThe root licence changed 1 time(s). The latest terms restrict what users, hosts or a buyer may do in ways the earlier ones did not. Code taken under the old terms stays under them, so both matter in diligence.
4 advisories against this project in the last 24 months, 2 high or critical
adequateThe newest was published on 2026-09-10. A project that publishes advisories is telling its users about its fixes, and the count and pace say how much security work it carries. Whether 4 of them are fixed in the code you ship could not be told from this history: its version is only known to be at least 0.14.6. Answer lives in: the release you run, set against each fixed version. The record is incomplete: NVD: 1 record names appflowy with nothing tying it to this repository (CVE-2026-16007).
| 2026-09-10: CVE-2026-88898 (high): AppFlowy-Cloud versions 0.7.2 through 0.9.64 fail to authorize callers against the workspace in the bulk publish endpoint path, allowing authenticated users to |
| 2026-09-10: CVE-2026-52097 (moderate): An issue in AppFlowy 0.11.8 allows a remote attacker to execute arbitrary code via the afLaunchUri, _afLaunchLocalUri (url_launcher.dart), OpenFilex.open, local |
| 2026-09-04: CVE-2026-85619 (high): AppFlowy-Cloud 0.9.64 fails to verify that requested collab objects belong to the workspace in authorization checks, allowing attackers to access documents and |
| 2026-09-04: CVE-2026-85622 (moderate): AppFlowy-Cloud through 0.9.64 fails to validate workspace membership when establishing WebSocket connections in the establish_ws_connection_v2 handler, allowing |
Observability & Operations
not assessableNot rated: only 4 of 16 checks could reach a conclusion here; the rest do not apply to this repository or could not read it.
Fit with the Acquirer
not assessableNot rated: structurally not assessable from a repository.
Read more, or read your own
The full report on appflowy-io/appflowy: every dimension, the questions for the room, and the audit log.
Survey a repository: free on public repositories. Private code is read on your own machine by a collector whose source you can read first.