Security Review
Round 2 · FlowDeck and Cloud Console · 19 Oct 2026
Verdict: no critical issues; one high. Database queries are safe in both apps, and the job tokens passed between FlowDeck and Cloud Console are checked properly. The new issues are an account-recovery gap, a few support-access edge cases in FlowDeck, Cloud Console's shared usage limits, and the deploy setup shared by both apps.
This page leaves out file locations, endpoints, parameters and reproduction steps on purpose. The full report is kept off the web.
0 criticalin either app
2 high1 new · 1 from round 1, raised
1 fix in progress · 1 owner action
1 fix in progress · 1 owner action
16 medium14 new · 1 from round 1, raised
13 fixes in progress · 3 owner actions
13 fixes in progress · 3 owner actions
37 low25 FlowDeck · 9 Cloud Console · 3 shared
most being fixed in the same branches
most being fixed in the same branches
On this page
What happens next
- In progress now: five fix branches, three for FlowDeck and two for Cloud Console. Each fix comes with a regression test, and each branch gets a security review before it is merged.
- Owner, this week: narrow the deploy token's permissions, limit what can write to Cloud Console's database, remove old deployments of the pre-migration app, and check the live privacy text.
- This sprint: the remaining medium and low items.
- This quarter: enforce the content security policy, add a general rate limit for signed-in requests, use a least-privilege database role, use separate keys for each purpose, and add one access test per route, generated from the API description.
- Process: static analysis and dependency checks in CI, security alerts for refused and rate-limited requests, a security checklist in pull requests, and key rotation dates.
High
IDs starting with R2- are new this round; the others are from round 1.
| ID | Severity | Area | Finding | Status |
|---|---|---|---|---|
| R2-FD-AUTH-1 | High | FlowDeck sign-in | Account recovery leaves earlier sign-in credentials working | Fix in progress |
| FD-011 | High | Deploy | A deploy token can reach more than it needs, including the other app | Owner action, raised |
Medium
| ID | Severity | Area | Finding | Status |
|---|---|---|---|---|
| R2-FD-AUTH-2 | Medium | FlowDeck account | Changing one's email asks for no proof of identity | Fix in progress |
| R2-FD-AUTH-3 | Medium | FlowDeck rate limits | Some network address ranges are not grouped for rate limiting | Fix in progress |
| R2-FD-AUTHZ-1 | Medium | FlowDeck AI | A cached AI answer can show cards to people who cannot open them | Fix in progress |
| R2-FD-AUTHZ-2 | Medium | FlowDeck support access | A support set-up exception does not expire | Fix in progress |
| R2-FD-AUTHZ-3 | Medium | FlowDeck support access | A board moved between teams keeps its outward links | Fix in progress |
| R2-FD-AUTHZ-4 | Medium | FlowDeck teams | Site admins' own team role is not applied | Fix in progress |
| R2-FD-AUTHZ-5 | Medium | FlowDeck email-in | Email-in ignores per-board access limits | Fix in progress |
| R2-FD-PRIV-1 | Medium | FlowDeck privacy | The privacy text promises deletion that the app does not do | Wording fix queued |
| R2-FD-INFRA-1 | Medium | Hosting | Old deployments of the pre-migration app may still be reachable | Owner action |
| R2-CC-QUOTA-1 | Medium | Cloud Console limits | One key or one member can use up a shared daily allowance | Fix in progress |
| R2-CC-QUOTA-2 | Medium | Cloud Console limits | Signed-in changes have no per-person budget | Fix in progress |
| R2-CC-QUOTA-3 | Medium | Cloud Console retries | Failed retries are not counted against any limit | Fix in progress |
| R2-CC-QUOTA-4 | Medium | Cloud Console storage | No per-project count caps, so storage can fill | Fix in progress |
| R2-X-1 | Medium | FlowDeck deploy | Deploy tools are installed without a lockfile in a privileged step | Fix in progress |
| R2-X-2 | Medium | Job tokens | Database write access could stand in for a signing key | Fix in progress |
| CC-027 | Medium | Deploy | Both apps' deploy keys share one store | Owner action, raised |
Low
| ID | Severity | Area | Finding | Status |
|---|---|---|---|---|
| FlowDeck (25) | Low | Various | Input checks on dates and email addresses, links in emails, export logging, support-access edge cases, invitation and ownership races, rate limits on public links, timeouts on outbound calls, rich-text cleaning, policy hosts, security logging | Mostly in progress |
| Cloud Console (9) | Low | Various | Alert recipients checked when alerts are sent, passkey edge cases, unsubscribe links, warning-queue fairness, deploy rebuild check, security alerts | Mostly in progress |
| Shared (3) | Low | Jobs | Job payload binding, the FlowDeck key's permissions, and noticing when the console is down | Partly in progress |
Round 1, re-checked
- Round 1's three highs (closed teams, board copies leaving a team, managers acting outside their team) still hold on every route added since.
- One open low from round 1, a support-access edge case on personal teams, is still open and is in this round's fixes.
- Two items were raised: the deploy token's reach (now high) and the shared key store (now medium).
- The content security policy is still in report-only mode, and the known gap in Cloud Console's signed-in rate limits is wider than first reported. Both are on the roadmap.
- More than 20 round-1 items were confirmed fixed in the code.
Scope and method
- A read-only review of FlowDeck (API, web app, deploy setup) and Cloud Console (Worker, pages, deploy setup) by eight parallel reviewers. The high item and the main cross-team issue were re-checked by hand.
- Every database query in both apps was checked. Dependency audits found no known vulnerabilities.
- Nothing was tested against the live services.
- Not covered: cloud settings that can't be seen from the code (token scopes, database grants, storage lifecycle, key restrictions).
- Status key: Fix in progress being fixed on a branch · Owner action needs a change in a provider dashboard · Holds re-checked and sound