We Built FFlake at Graph Hacks, and Graphs Made More Sense Than We Expected

By the FFlake team, FalkorDB Graph Hacks 2026 - Constructing FFlake, a graph-native security analysis tool, during a hackathon presented unique challenges as time constraints took effect. Dipanshu and I developed FFlake to examine the concept of an identity lacking direct access to a sensitive resource but able to reach it through a chain of related entities.

The objective was to investigate how connections between entities could potentially disclose risks. FFlake operates by leveraging FalkorDB to trace capability paths between a starting point and a target entity. Rather than treating each permission or identity separately, we delve into the interconnected relationships that could indicate a possible threat.

The application then assists in analyzing the risk, proposing possible interventions, and simulating the impact of alterations on the remaining pathways. This approach aims to provide a clearer understanding of how a risky pathway exists, rather than merely indicating that something might be amiss. FalkorDB was chosen because the graph database is not merely a backend system.

It is integral to the investigative process. Our approach relies heavily on relationships: an identity links to various entities, which further connect to permissions or resources. These connections can reveal paths that are not immediately apparent when examining individual components. The strength of FalkorDB lies in its capability to represent and query these intricate relationships, which forms the backbone of FFlake's path discovery workflow and the evidence it presents.

The project's complexity extended beyond conceptualization. It entailed developing an intuitive interface for users to input starting and target entities, discovering paths, assessing risks, and exploring potential remedies. Additionally, we incorporated simulation-based verification, tracked investigation history, and generated remediation suggestions for manual review.

Practical aspects included linking the backend to FalkorDB Cloud, deploying the frontend, resolving API configuration problems, and addressing UI glitches, which became particularly significant when the project was being demonstrated to others. The successful deployment marked a significant milestone, transforming the project from a personal endeavor to a live application accessible to others.

The experience highlighted the importance of a security tool that goes beyond presenting a risk score. Users require comprehension of the underlying evidence, insight into potential modifications, and the ability to evaluate suggested changes through simulations. FFlake is designed to facilitate this investigative process, leading with evidence and proposing adjustments that can be validated for their effectiveness.

While there is room for improvement, particularly in custom graph setup and enhancing the user experience for newcomers, we now possess a functional application demonstrating the core workflow. Explore FFlake at: https://f-flake.vercel.app For more information, visit the project's GitHub page: https://github.com/revv-a/FFlake The FFlake tool, developed by Dipanshu and myself for FalkorDB Graph Hacks 2026, demonstrates a graph-based investigation approach focused on understanding risky paths, analyzing risks, and simulating changes to improve security posture.