FFlake 團隊在 Graph Hacks 開發安全調查工具：圖結構比預期更有助理解問題

By the FFlake team | FalkorDB Graph Hacks 2026

Honestly, building a project during a hackathon is a different experience when the clock is actually ticking.

Dipanshu and I built FFlake, a graph-native security investigation tool, for FalkorDB Graph Hacks. The idea was to explore a problem that gets interesting when you stop looking at permissions individually: what if an identity cannot access a sensitive resource directly, but can still reach it through a chain of connected relationships?

That is the problem we wanted to work on.

So, what does FFlake actually do?

Imagine an identity called external-bot and a sensitive resource called prod-secrets.

Looking at those two names alone does not tell us much. What matters is everything connecting them.

FFlake uses FalkorDB to investigate capability paths between a starting entity and a target entity. Instead of treating every permission or identity as an isolated thing, we can explore how connected relationships might create a potential risk.

The application then helps us analyze that risk, inspect candidate interventions, and simulate proposed changes to see how the remaining paths compare.

The goal is simple: make it easier to understand how a risky path exists, not just that something might be wrong.

Why FalkorDB?

The graph is not just a database sitting behind the UI. It is central to how the investigation works.

Our use case depends on relationships. An identity connects to other entities, those entities connect to permissions or resources, and those connections can form paths that are not obvious when examined separately.

FalkorDB gave us a graph-native way to represent and query those relationships. It became the foundation for the path discovery workflow and the evidence shown by FFlake.

That was the part we found especially interesting: the structure of the data itself helps explain the problem.

Building it was not just about the idea

Getting from an idea to something people can actually open and try meant working across the frontend, backend, graph database, and deployment setup.

We built an investigation interface where users can enter a starting entity and a target, discover paths, analyze risk, and explore possible interventions. We also worked on simulation-based verification, investigation history, and remediation proposals for human review.

Then came the practical stuff: connecting the deployed backend to FalkorDB Cloud, getting the frontend deployed, fixing API configuration issues, and chasing down UI bugs that somehow become very important when someone else is about to see your project.

The live deployment was a milestone in itself. A project feels very different when it is no longer running only on your own machine.

Can you try your own scenario?

Yes, you can change the starting and target entity names in the interface. There is one catch, though: those entities and their relationships need to exist in the graph being queried. Typing a new name does not automatically create a new graph.

For now, the demo graph is the easiest way to explore the workflow. Making custom graph setup and importing your own data more accessible is one of the improvements we would like to work on next.

We also want to explore deeper AI-agent integration. At its current stage, FFlake focuses on graph-based investigation, risk analysis, and simulation rather than claiming fully autonomous security decision-making.

What we are taking away from this

One thing this build reinforced for us is that a useful security tool needs more than a risk score. People need to understand the evidence, see what could be changed, and evaluate a proposed fix without immediately changing production permissions.

That is the direction we wanted FFlake to take: investigation first, evidence next, and proposed changes that can be evaluated through simulation.

We still have plenty to improve, especially around custom graph setup and making the experience smoother for first-time users. But we now have a working deployed application that brings the core workflow together.

Try FFlake: https://f-flake.vercel.app

Code on GitHub: https://github.com/revv-a/FFlake

Built by Dipanshu and me for FalkorDB Graph Hacks 2026.

And yes, getting the graph connected and the deployment working before the deadline was very much part of the experience.