Canon
All teardowns
FlowiseAI logo

Free Verify scan · FlowiseAI/Flowise

Flowise scores 63/100

Visual AI-agent builder (archived Aug 2026).

Commit 9291856 · 132 controls · Oct 16, 2026 · Re-checked daily

Scanned with public access only. Customer results are never published.

Delivery controls score63
Flowise
42median 6886

Out of 100. Stronger than 25% of the 68 other assessed repositories.

Score

63/100

Rank 52 of 69 · median 68

Gaps

34

1 more than the median of 33

Critical

1 controls

1 root cause

Not visible

23

Needs admin access

What Flowise does wellDefault branch identifiedBranch strategy observableDefault branch protected by rulesetVisibility and ownership recordedWork arrives through a tracked path
Gaps34
Flowise
15median 3361

Visible controls Verify found unmet. Fewer is better. Stronger than 40% of the 68 other assessed repositories.

How does your team compare?

This is what Canon Verify found in Flowise's public configuration. Your team's process probably has the same gaps. Most private repos do.

See how your team scores

5 minutes. No repository access needed.

Scan your own repo with Verify (free)

Analysis

Our read

01

Docs leads the assessment.

5 of 5 visible controls pass in docs.

02

Agents & AI has the most room to improve.

1 visible control remain open in agents & ai.

Priority

Fix these first

critical

Required checks match workflow names

Covers 4 controls
  • Required checks match workflow names
  • Required status checks strict
  • Required check includes tests
  • Required lint check

What Verify read

Required checks: none

Risk: If required checks do not match the jobs that run, a rule appears to protect the branch while enforcing nothing.

text
Align required checks with jobs.

Have this gap too? Start from the Release Gate flow.

Open in Design
high

CODEOWNERS or review assignment

Covers 4 controls
  • CODEOWNERS or review assignment
  • CODEOWNERS or OWNERS file
  • Maintainer roster
  • Review of high-risk dependency changes

What Verify read

No tree evidence for owners.

Risk: With no ownership file, review lands on whoever is available rather than whoever understands the code.

text
Add CODEOWNERS.
high

Workflow permissions least-privilege

Covers 1 control
  • Workflow permissions least-privilege

What Verify read

One or more workflows do not declare a permissions block.

Risk: Broadly permissioned workflows hand a write token to every action they call, including third-party code.

text
Set least-privilege GITHUB_TOKEN.

Overview

Control map

Public-access limit

23 controls this scan couldn't read

This free scan used public access only. These controls live in settings only a repository admin can read. Verify checks them on your connected repository.

  • Pull-request requirement on default branchcritical
  • Required reviewscritical
  • Force-push restrictedhigh
  • Administrator bypass restrictedhigh
  • Tag protectionhigh
  • Stale reviews dismissedhigh
  • Last-push approval requiredhigh
  • Self-merge restrictedhigh
  • Bypass actors justifiedhigh
  • Push protection enabledhigh
  • Dependabot alertshigh
  • Secret scanning alertshigh
  • SAST required on default branchhigh
  • Environment secrets scopedhigh
  • Signed commits requiredmedium
  • Branch deletion protectedmedium
  • Conversation resolution requiredmedium
  • Merge queue or serialized mergemedium
  • Secret custodiansmedium
  • Audit of privileged actionsmedium
  • Linear history or documented merge methodlow
  • Private vulnerability reportinglow
  • Wait timer or freeze windowlow
Get Verify

Method

How Verify works

01

Read

Verify reads the repository at a pinned commit: settings, rulesets, workflows, and files.

02

Judge

Each control is checked against a written expectation. Same inspector, same criteria, every repository.

03

Prove

Every result shows the evidence Verify read. Assessments re-run daily, and changes are logged.

132 controls · 69 repositories assessed · re-run daily

This free scanVerify on your repository
AccessPublicGitHub App you install
Controls read91 of 91All 91
Private repositoriesNoYes
ResultsPublished herePrivate to your organization

Evidence locker

Every control Verify checked

Governance

4 of 12 pass

Review

9 of 26 pass

CI & tests

20 of 30 pass

Code quality

3 of 8 pass

Security

6 of 20 pass

Agents & AI

0 of 8 pass

Release & ops

10 of 22 pass

Assessment timeline

Canon re-assesses this repository daily. An entry appears only when something changed — the score, a control's outcome, or a control ceasing to apply.

Sep 21 · 62Oct 16 · 63
  • Sep 30, 2026SBOM or dependency graph · Security — needs repository admin access → confirmed9291856
  • Sep 30, 2026Delivery controls score 62 → 639291856
  • Sep 29, 2026Delivery controls score 63 → 629291856
  • Sep 29, 2026SBOM or dependency graph · Security — confirmed → needs repository admin access9291856
  • Sep 25, 2026SBOM or dependency graph · Security — needs repository admin access → confirmed9291856
  • Sep 25, 2026Delivery controls score 62 → 639291856
  • Sep 23, 2026SBOM or dependency graph · Security — confirmed → needs repository admin access9291856
  • Sep 23, 2026Delivery controls score 63 → 629291856
  • Sep 22, 2026Delivery controls score 62 → 639291856
  • Sep 22, 2026SBOM or dependency graph · Security — needs repository admin access → confirmed9291856

Get this report for your own repository.

Canon Verify runs the same inspection on your private repo. Read-only GitHub App. First scan free.

Scan your repo freeSee how your team scores

Read-only access. No code stored. How Canon handles your data →

View FlowiseAI/Flowise on GitHub

Maintain Flowise? If anything here is inaccurate or out of date, email security@strikelabs.co and we'll correct it.