Test scope, screenshots, checkpoint findings and tier rationale were supplied by an identified reviewer. Identity is retained internally unless public attribution is explicitly enabled.
Cybersecurity / AI · South AfricaFull evidence record
FlowLessAI
FlowLessAI is an AI code-auditing product intended to connect to GitHub repositories, identify software risks and propose fixes, with a companion CLI distributed separately.
Sandbox Africa checked the submitted evidence and promoted the verified checkpoint record. Any visible adjustment is identified rather than silently rewritten.
The official public tier and technical record below are the verified publication outcome.
Tier 0 — Concept / Vaporware
Keep Tier 0 pending reassessment. The product is more than a landing page, but no available route reached the core service during the review.
Strongest supporting evidence
The platform's backend API was independently confirmed to be down via HTTP 521, a Cloudflare-generated error explicitly distinguishing Cloudflare's own working infrastructure from the non-responding origin host. This single, technically unambiguous fault explains all other failures observed: two OAuth providers rejecting sign-in identically, an email signup form that never activates, and a CLI login call that fails the same way. The site's marketing and documentation are unusually thorough for a Tier 0 platform, but no path — web or CLI — reaches a functioning product.
Why the next tier is not yet supported
Tier 1 requires the core loop to work, even in unpolished form. It does not: every account creation and authentication path independently fails, traced to a confirmed backend outage rather than an interface or scalability shortfall. A non-operational backend server is a more fundamental failure than the access limitations found on most other platforms this stream, most of which were reachable but simply gated behind a sales process.
Verified findings and limitations
Direct review observations
The intern tried Google OAuth, GitHub OAuth and email signup; all failed. The CLI package installed, but its login call returned HTTP 521 from the platform API origin, preventing any audit workflow.
Independent verification
FlowLessAI published a 2026 launch note offering free credits and GitHub connection, showing an active product launch effort, but this does not overturn the backend outage observed in the assessment.
Observed issues
Every authentication route failed and the API origin was unavailable during testing.
Testing limitations
No repository audit, finding generation or pull-request workflow could be executed.
What was actually assessed
Loaded flowlessai.one and reviewed all pages, confirming no dead links and a detailed six-step product walkthrough. Confirmed South African origin via LinkedIn, since it was not stated on the primary site. Attempted account registration via all three available methods in sequence: Google OAuth, which returned "Access Denied"; GitHub OAuth, which returned the identical error; and email/password signup, where the "Create account" button never activated despite valid input in both fields. With web signup fully blocked, installed the platform's separate open-source CLI tool, vibe-auditor, via npm — the first install attempt failed on a local network reset, the second succeeded. Located the correct command name (auditor) after the package name itself was not recognised as a command. Ran auditor login to test the CLI authentication path independently of the web interface; this returned HTTP 521, a Cloudflare-generated error confirming Cloudflare's network was functioning while the origin backend (api.flowlessai.one) was not responding. Finally, checked the site's TLS certificate directly via browser inspection to confirm HTTPS configuration on the frontend.
Environment / device / browser
Edge on Windows
Account or access type
Business account
Access limitations
All three available web registration methods failed — Google OAuth and GitHub OAuth both returned "Access Denied," and the email/password signup button never activated. The platform's separate CLI tool was tested as an alternative path but also failed to authenticate, returning HTTP 521, which confirmed the backend API server itself was non-operational at the time of testing. As a result, the platform's sole stated function — automated code auditing — could not be exercised by any available method, web or CLI. This is a total access limitation, but one grounded in a specific, independently verifiable technical cause (a confirmed server outage) rather than a sales gate, credential requirement, or deliberate restriction.
What was observed
These images formed part of the evidence pack considered during verification. Full-standard records retain the contributor's factual caption for each screenshot.
Evidence 1
CLI status check Output of auditor status, run before authentication. Confirms the CLI tool installed and runs correctly, reporting "Not logged in" and directing the user to auditor login — establishing the CLI itself is functional prior to the backend failure found in later testing.
Evidence 2
Web OAuth failure Result of attempting sign-up via Google OAuth on flowlessai.one. Returns "Access Denied — You do not have permission to sign in" at /api/auth/error?error=AccessDenied, despite the homepage advertising free, self-serve access with no card required.
Seven checkpoint assessment
The verified result is the official public checkpoint record. For earlier-standard reviews, these findings may have been reconstructed from preserved evidence during Sandbox Africa’s 2026 audit; they are not presented as if the contributor originally completed a structured worksheet. Contributor-submitted checkpoint wording is shown only where explicit public reviewer attribution has been enabled.
Step 1 — The Existence & Accessibility Check
Is it live?
Checking for dead links, infinite loading screens, or "Coming Soon" landing pages masquerading as live products.
Sandbox verifiedpass
Site loads fully with no dead links across Home, FAQ, Pricing, Team and Contact pages.
Onboarding friction
Can a user or enterprise actually sign up, or is it gated behind broken "Contact Sales" forms?
Sandbox verifiedfail
The homepage advertises "Start free — no card needed" and "Get started — it's free." All three available registration paths were tested and none succeeded. Google OAuth and GitHub OAuth both returned "Access Denied — You do not have permission to sign in" at /api/auth/error?error=AccessDenied. On the email/password path, valid values were entered into both fields, but the "Create account" button remained visibly inactive and never became clickable, with no stated requirement explaining why. No account could be created by any of the three available methods.
Step 2 — Functional Testing (The "Try It Out" Phase)
Core loop execution
Does the application actually do what it claims to do? (e.g. a payment gateway completing a test transaction, a logistics app's routing engine working.)
Sandbox verifiedfail
Web signup could not be completed by any method, so the GitHub audit workflow could not be tested directly. The separate vibe-auditor CLI tool was installed successfully via npm (npm i -g vibe-auditor; correct command is auditor, not the package name — a minor documentation gap). Running auditor login returned HTTP 521 ("Web server is down"), a Cloudflare-generated error. Cloudflare's own diagnostic panel confirmed the browser and Cloudflare's network were both functioning correctly, while the origin host, api.flowlessai.one, returned an error. This confirms the platform's backend API was non-operational at the time of testing, providing a single root cause for the web signup failures, the inert email form, and the CLI login failure alike.
User experience (UX) & interface (UI)
Assessing the logical flow, responsiveness, and basic accessibility of the platform.
Sandbox verifiedfail
The email signup form gave no error message or explanation when submission was blocked, leaving the user with no information about why account creation failed. The CLI tool's own documentation names the package vibe-auditor but the installed command is auditor, an inconsistency that would confuse a first-time user following the website's own installation instructions.
Step 3 — Technical & Architectural Assessment
Performance
Load speeds, uptime reliability, and basic stress responses.
Sandbox verifiednot assessed
No authenticated feature could be reached by any method, so load behaviour and reliability under active use could not be tested.
Integration readiness
Availability, clarity, and functionality of API documentation and webhooks.
Sandbox verifiedpartial
The CLI tool installed correctly via npm and exposed a well-structured command interface (auditor login, auditor status, auditor ., auditor resume), confirming the package itself is properly built and distributed. The website separately documents a detailed six-step GitHub integration workflow with screenshots. However, the backend serving both interfaces was confirmed non-operational (HTTP 521), so neither integration path could be exercised end-to-end.
Security basics
SSL certification, basic encryption standards, and data handling transparency.
Sandbox verifiedpartial
HTTPS confirmed via a valid, currently active TLS certificate for www.flowlessai.one, issued by Let's Encrypt on 26 June 2026, expiring 24 September 2026 — a standard domain-validated certificate consistent with automated renewal. Marked Partial rather than Pass because basic transport security on the frontend is confirmed, while the backend serving authentication and the core product (api.flowlessai.one) was independently confirmed non-operational via HTTP 521 — meaning the certificate protects a connection to a service that, at the point of testing, could not actually authenticate or serve any user.
Company right of reply
Claim company profile
Represent FlowLessAI?
Claiming verifies company ownership and enables a response or additional evidence. It does not permit editing of the independent review.