reconurge/flowsint: Self-Hosted OSINT Graph Platform for Ethical Investigations

reconurge/flowsint: Self-Hosted OSINT Graph Platform for Ethical Investigations

Open-source intelligence (OSINT) investigations generate chaotic, interconnected data—domains, IPs, social profiles, cryptocurrency wallets, and organizational affiliations that analysts must manually correlate. Most commercial tools lock this data behind SaaS walls, raising compliance and privacy concerns. reconurge/flowsint addresses both problems: it offers a visual graph exploration interface for OSINT work while keeping all data self-hosted and local. With 7,288 GitHub stars, 909 forks, and an active TypeScript/Python^{↗ Bright Coding Blog} codebase under Apache 2.0, Flowsint has gained traction among cybersecurity analysts, journalists, and researchers who need transparent, extensible investigation infrastructure without surrendering data custody.

What is reconurge/flowsint?

reconurge/flowsint is an open-source graph-based investigation platform designed for reconnaissance and OSINT workflows. Built primarily in TypeScript (frontend) with Python backend services, it provides a visual interface for exploring relationships between entities—domains, IP addresses, individuals, organizations, cryptocurrency wallets—through an interactive graph that scales to thousands of nodes without performance degradation.

The project is maintained by reconurge and emphasizes ethical use, with an explicit ETHICS.md file and prominent ethical-use badges. The last commit as of this writing was July 1, 2026, indicating active development. The repository carries an Apache License 2.0, permitting commercial and research use within its ethical framework.

Flowsint distinguishes itself through architectural modularity: five autonomous modules handle types, enrichment logic, core orchestration, API serving, and frontend rendering. This separation allows contributors to extend specific capabilities—adding new entity types or enrichers—without touching unrelated code. The backend leverages PostgreSQL^{↗ Bright Coding Blog} for relational data, Neo4j for graph storage, Redis for caching, and Celery for task queuing, all containerized via Docker^{↗ Bright Coding Blog}.

The tool's ethical positioning is explicit: it targets "cybersecurity researchers and analysts, journalists and OSINT investigators, law enforcement or fraud investigation teams, and organizations conducting internal threat intelligence." It prohibits unauthorized surveillance, harassment, doxxing, and political manipulation—making its ethical constraints a feature for compliance-conscious organizations.

Key Features

Visual Graph Exploration The frontend renders interactive graphs for relationship analysis. The README explicitly states it is "built for performance (no lag even on thousands of nodes)"—a critical capability when investigations balloon from single entities to sprawling networks.

Automated Data Enrichment Flowsint includes 20+ built-in enrichers across nine categories: Domain (reverse DNS, subdomain discovery, WHOIS, history), IP (geolocation, ASN mapping), ASN-to-CIDR expansion, CIDR-to-IP enumeration, social media^{↗ Bright Coding Blog} (Maigret username search), organization intelligence, cryptocurrency (wallet transactions, NFT ownership), website crawling, email breach checking, and phone number verification. An N8n connector enables workflow automation integration.

Self-Hosted Privacy All data stores locally by default. The README emphasizes: "OSINT investigations need a high level of privacy. Everything is stored on your machine." For team deployments, a single exposed port (5173) proxies to internal services; PostgreSQL, Redis, Neo4j, and the API bind to localhost.

Modular Architecture Five discrete modules—flowsint-types, flowsint-enrichers, flowsint-core, flowsint-api, and flowsint-app—enforce clean dependency boundaries. New enrichers or entity types plug in without disrupting existing functionality.

Security Hardening Network deployments include DNS rebinding protection via nginx host-header allowlisting, configurable authentication secrets, and AES-256-GCM-equivalent vault encryption for API keys via MASTER_VAULT_KEY_V1.

Cross-Platform Deployment Linux/macOS installs use Make; Windows supports Command Prompt and PowerShell without Make dependency. Pre-built images from GitHub Container Registry eliminate local builds for production deployments.

Use Cases

Threat Intelligence Correlation A security analyst investigating a phishing campaign starts with a suspicious domain. Using Flowsint's domain enrichers, they resolve to IPs, map to ASNs, expand CIDR ranges, and identify co-located infrastructure—all visualized as a graph revealing shared hosting patterns or fast-flux networks.

Journalistic Source Protection A journalist verifying corporate connections traces organization-to-ASN mappings, cross-references domain ownership, and extracts website text for documentary evidence—without uploading sensitive queries to third-party SaaS platforms that might log or leak investigation targets.

Cryptocurrency Forensics An investigator traces wallet-to-transaction histories and NFT ownership across chains, correlating with email breach data or social media profiles to identify actors behind wallet clusters—useful for exchange compliance and law enforcement subpoena preparation.

Insider Risk Assessment An organization's security team monitors for exposed employee credentials via email-to-breach enrichers, correlates with individual-to-organization mappings, and assesses whether leaked passwords overlap with corporate systems.

Automated OSINT Pipelines Via the N8n connector, analysts integrate Flowsint into broader automation workflows—triggering enrichment on IOC ingestion, feeding results to SIEMs, or generating scheduled reports on infrastructure changes.

Installation & Setup

Flowsint deploys entirely via Docker. No language runtimes need local installation beyond Docker itself.

Linux / macOS

Prerequisites: Docker, Make.

# Clone repository
git clone https://github.com/reconurge/flowsint.git
cd flowsint

# Production deployment with pre-built images
make prod

The make prod command orchestrates docker-compose.prod.yml, pulling images from GitHub Container Registry and starting all services.

Windows (Command Prompt or PowerShell)

Prerequisites: Docker Desktop (running), Git.

# Clone repository
git clone https://github.com/reconurge/flowsint.git
cd flowsint

# Create environment files from template
copy .env.example .env
copy .env.example flowsint-api\.env
copy .env.example flowsint-core\.env
copy .env.example flowsint-app\.env

# Start services with pre-built images
docker compose -f docker-compose.prod.yml up -d

Windows requires explicit .env file creation because Make handles this automatically on Unix systems.

First Access

Navigate to http://localhost:5173/register and create an account. No default credentials exist—this is intentional for single-user privacy.

Network Deployment

For team or server access, clone and configure as above, then edit .env before exposing:

git clone https://github.com/reconurge/flowsint.git
cd flowsint
cp .env.example .env
# Edit .env with secure secrets
docker compose -f docker-compose.prod.yml up -d

Critical security steps for network exposure:

Generate authentication secrets:

# JWT signing secret
openssl rand -hex 32

# API key encryption key
python3 -c "import os, base64; print('base64:' + base64.b64encode(os.urandom(32)).decode())"

Update AUTH_SECRET, MASTER_VAULT_KEY_V1, and NEO4J_PASSWORD in .env. Add your server hostname to flowsint-app/nginx.conf in the map $http_host $is_flowsint_host block—the default allowlist permits only localhost / 127.0.0.1 / [::1] as DNS rebinding protection.

For HTTPS, place a reverse proxy in front of port 5173. Example Caddy configuration:

flowsint.example.com {
    reverse_proxy 127.0.0.1:5173
}

Bind the app port to localhost in docker-compose.prod.yml ("127.0.0.1:5173:8080") to enforce HTTPS-only access.

Real Code Examples

The README provides explicit commands for development and testing workflows.

Development Startup (Linux/macOS)

make dev

This launches the development compose profile with hot-reload enabled. The application remains accessible at http://localhost:5173.

Development Startup (Windows)

# Create .env files first (see Windows production setup)
docker compose -f docker-compose.dev.yml up -d --build
docker compose -f docker-compose.dev.yml logs -f

The --build flag compiles local images rather than pulling pre-built releases. The logs -f command streams all container output for debugging.

Module Testing

Each module maintains its own test suite, executed via uv (the modern Python package manager):

# Test core utilities and orchestration
cd flowsint-core
uv run pytest

# Test Pydantic type definitions
cd ../flowsint-types
uv run pytest

# Test enrichment logic
cd ../flowsint-enrichers
uv run pytest

# Test API endpoints
cd ../flowsint-api
uv run pytest

These commands reflect the project's modular testing strategy—isolated per component, using Poetry/uv for dependency management. The README notes test suites are "incomplete," indicating active development and contribution opportunities.

Version Pinning

For reproducible deployments, set FLOWSINT_VERSION in .env:

# Pin to specific release instead of latest
FLOWSINT_VERSION=1.2.10

This prevents unexpected updates when restarting containers.

Advanced Usage & Best Practices

Environment Segregation The .env.example template serves both development and production, but network deployments demand unique secrets. Rotate AUTH_SECRET and MASTER_VAULT_KEY_V1 on any credential exposure—both are single points of failure for authentication and encrypted vault access.

Graph Database Tuning Neo4j performance scales with available memory. For large investigations (10,000+ nodes), allocate sufficient heap to the Neo4j container and consider periodic graph compaction. The README does not specify tuning parameters—consult Neo4j documentation for JVM heap sizing.

Enricher Rate Limiting External APIs (WHOIS, DNS resolvers, breach databases) impose rate limits. The Celery task queue in flowsint-core handles asynchronous execution, but monitor queue depth during bulk operations. The N8n connector can throttle workflow triggers to respect upstream limits.

Backup Strategy PostgreSQL and Neo4j volumes contain investigation data. Implement volume snapshots or pg_dump / neo4j-admin dump procedures for disaster recovery. The README does not cover backup procedures—this remains operator responsibility.

Contribution Workflow New enrichers belong in flowsint-enrichers; new entity types in flowsint-types. The dependency graph (app → api → core → enrichers → types) prevents circular imports. Write tests and update documentation per module.

Comparison with Alternatives

Flowsint occupies a middle ground: more visual and modular than SpiderFoot, fully self-hosted unlike Maltego's cloud dependency, and more structured than TheHarvester's script-based approach. Its ethical-use framework and TypeScript frontend distinguish it in a field dominated by Python-native tools. Trade-offs include younger ecosystem maturity (7,288 stars vs. Maltego's decade-plus presence) and incomplete test coverage noted in the README.

FAQ

Is reconurge/flowsint free to use commercially? Yes, under Apache License 2.0. The ETHICS.md imposes use constraints but does not restrict commercial deployment for lawful investigations.

What hardware resources are required? Docker is mandatory. Minimum specs depend on investigation scale; the README does not specify, but Neo4j and PostgreSQL benefit from 4GB+ RAM for moderate workloads.

Can I run this without Docker? The README documents only Docker-based deployment. Manual installation would require reverse-engineering compose files and dependency resolution.

How do I add custom enrichers? Implement in flowsint-enrichers following existing module patterns, add corresponding types in flowsint-types, and register via flowsint-core orchestrator.

Is there a cloud/SaaS version? No. The architecture is explicitly self-hosted; all data remains on your infrastructure.

What browsers are supported? The README does not specify; the modern TypeScript frontend likely targets evergreen browsers.

How current is the project? Last commit July 1, 2026, with active issue tracking and community Discord server.

Conclusion

reconurge/flowsint delivers a pragmatic balance for teams needing visual OSINT investigation capabilities without SaaS dependency or data exposure. Its modular architecture rewards technical users who want to extend enrichment logic, while Docker-based deployment keeps operational complexity manageable. The explicit ethical framework and local-only storage model address compliance requirements that generic tools ignore.

This tool suits cybersecurity analysts, investigative journalists, fraud researchers, and internal security teams comfortable with self-hosted infrastructure. It is less appropriate for users wanting managed services or those unwilling to maintain Docker environments.

The project is early-stage with incomplete test coverage, but the 7,288-star community and active development suggest maturing momentum. For teams evaluating OSINT platforms, Flowsint warrants direct testing against your specific entity types and investigation volumes.

Explore the repository, review the ethical guidelines, and deploy locally: https://github.com/reconurge/flowsint