selfhost.directory

The index of self-hostable projects — ranked, categorized and served with live updates.
Own your data and stop giving it to big tech.

GitHub
pwnflow logo

Self-host pwnflow

1.0.3

Visual mind-mapping platform for offensive security

BetaOpen SourceAGPL-3.0
GitHub
Install
Updated9 hours ago
LanguageTypescript
Setup difficultyModerate
Stars
281
Ports
5173 (Frontend development server), 8000 (Backend API), 8001 (AI Microservice API), 5555 (Flower Celery monitoring), 80 (Production HTTP (nginx)), 443 (Production HTTPS (nginx))
Requires
Neo4j, Redis
Install with Docker Compose
Pwnflow mind map interface showing security testing workflowPwnflow mind map with nodes and connectionsPwnflow project view with methodology trackingPwnflow UI showing command templates or node details

What is pwnflow?

Pwnflow is a self-hosted mind-mapping tool for security professionals doing penetration testing, red teaming, and incident response. It lets you build interactive visual workflows, get AI-powered node suggestions via Google Gemini, save command templates with variables, and track methodology progress. Data stays on your infrastructure with AES-256-GCM encrypted exports, JWT authentication, and AI that only sees node titles. You can import methodologies from GitHub, export to CSV or encrypted formats, and migrate from older versions. The stack is React 19, TypeScript, Vite, TailwindCSS, XYFlow on the frontend, and FastAPI with Neo4j and Redis on the backend. Deploy with Docker Compose using the provided run.sh script for development or production behind nginx. Registration is off by default; admins create users via CLI.

Should you self-host pwnflow?

pwnflow scores 44/100 on selfhost.directory (how scoring works) and ranks #56 of 78 in Security. It has 281 GitHub stars.

There was no stable release in the past 12 months, so check the repository's recent activity before you rely on it.

Setup is moderate: expect some configuration beyond a single command. It is AGPL-3.0-licensed and written mostly in Typescript.

Its closest alternative on selfhost.directory is pentagi (83/100, 32 629 stars). It scores higher overall, so compare the two before you pick. See pwnflow vs pentagi side by side.

Features

  • AI-Powered AssistanceRequires GOOGLE_API_KEY
  • AI Privacy
  • Bulk Operations
  • Command Templates
  • Encrypted Exports
  • Interactive Mind Maps
  • Legacy Migration
  • Multiple Export Formats
  • Progress Tracking
  • Template Import
  • Token-based authentication
  • Zero telemetry

pwnflow README

How to install pwnflow

Install pwnflow with Docker Compose

Docker and Docker Compose
Environment variables
SECRET_KEY, ALGORITHM, ACCESS_TOKEN_EXPIRE_MINUTES, NEO4J_URI, NEO4J_USER, NEO4J_PASSWORD, NEO4J_DATABASE, NEO4J_AUTH, REDIS_URL, BACKEND_CORS_ORIGINS, ENABLE_REGISTRATION, GOOGLE_API_KEY, GEMINI_MODEL, FRONTEND_API_URL, VITE_APP_ENV, VITE_ENABLE_ANALYTICS, ENABLE_ANALYTICS, APP_VERSION, APP_ENV

./run.sh prod

Then create admin user:

docker exec -it pwnflow-backend-prod python create_user.py create admin admin@yourcompany.com

Runs behind nginx reverse proxy on ports 80/443. Creates .env.production with secure defaults. Requires updating BACKEND_CORS_ORIGINS with your domain. Registration disabled by default.

How to configure pwnflow

  • ACCESS_TOKEN_EXPIRE_MINUTES11520Token expiration in minutes (8 days = 11520)

    Token expiration in minutes (8 days = 11520)

  • ALGORITHMHS256JWT algorithm

    JWT algorithm

  • APP_ENVproductionApplication environment

    Application environment

  • APP_VERSION1.0.0Application version for AI service

    Application version for AI service

  • BACKEND_CORS_ORIGINS["*"] (dev) / ["https://yourdomain.com", "https://www.yourdomain.com"] (prod)Allowed CORS origins for the backend API

    Allowed CORS origins for the backend API

  • ENABLE_ANALYTICStrueEnable analytics (passed to frontend build)

    Enable analytics (passed to frontend build)

    values: true, false

  • ENABLE_REGISTRATIONfalseEnable user registration (disabled by default for security)

    Enable user registration (disabled by default for security)

    values: true, false

  • FRONTEND_API_URL/api/v1Frontend API base URL (relative or absolute)

    Frontend API base URL (relative or absolute)

  • GEMINI_MODELgemini-2.0-flashGemini model to use for AI features

    Gemini model to use for AI features

  • GOOGLE_API_KEYGoogle Gemini API key for AI features

    Google Gemini API key for AI features

  • NEO4J_AUTHneo4j/passwordNeo4j Docker auth format (username/password)

    Neo4j Docker auth format (username/password)

  • NEO4J_DATABASEneo4jNeo4j database name

    Neo4j database name

  • NEO4J_PASSWORDpassword (dev)Neo4j password

    Neo4j password

  • NEO4J_URIbolt://localhost:7687 (dev) / bolt://neo4j:7687 (prod)Neo4j connection URI

    Neo4j connection URI

  • NEO4J_USERneo4jNeo4j username

    Neo4j username

  • REDIS_URLredis://localhost:6379 (dev) / redis://redis:6379 (prod)Redis connection URL

    Redis connection URL

  • SECRET_KEYJWT secret key for token signing (auto-generated)

    JWT secret key for token signing (auto-generated)

  • SERVICE_VERSION${APP_VERSION:-1.0.0}AI service version

    AI service version

  • VITE_API_BASE_URLhttp://localhost:8000/api/v1 (dev) / ${FRONTEND_API_URL:-/api/v1} (prod)Frontend API base URL for Vite build

    Frontend API base URL for Vite build

  • VITE_APP_ENVproductionFrontend app environment

    Frontend app environment

  • VITE_ENABLE_ANALYTICStrueEnable analytics in frontend

    Enable analytics in frontend

    values: true, false

pwnflow releases & version history

Even more releases RSS

More in Application Management

Rate this project

Click to rate — no account needed.

0 comments

Posting as guest
Loading comments…