The code can look right and still let the wrong person in. FlowRail connects your design requirements to security checks before Claude writes the code.
Keep building with Claude. Give the security decisions somewhere to live.
01
Describe what must hold.
Who can see the invoice? Where can a report go? FlowRail reviews your spec and turns supported security requirements into scoped rules.
DESIGN → REQUIREMENTS
02
Catch the contradiction.
When a proposed write breaks a rule, FlowRail can block it before it reaches disk. Claude gets the finding, corrects the code and retries.
PROPOSED WRITE → CHECK
03
Follow what changed.
See the original requirement, the finding and the next verification in one review. Missing evidence stays visible, even when a write passes.
FINDING → CORRECTION → EVIDENCE
FlowRail in action
Small mistakes. Different consequences.
Two narrated walkthroughs. Real checks, controlled staging examples.
DEMO 01 / ACCESS CONTROL
One URL. Someone else’s invoice.
The user is authenticated. The code still trusts a workspace from the URL. Follow the requirement from the design review to the blocked write, correction and dashboard evidence.
Founder narration · captions available · controlled staging recording
About the evidence in this recording
The flawed code was deliberately introduced, and product fixes occurred between takes. The recorded correction passed 16 active checks and 23 separately run behavior tests. The overall review remained open. Screenshots are from the recorded run; editorial diagrams are illustrations. These numbers describe this example, not a detection-rate benchmark.
DEMO 02 / PUBLICATION SCOPE
A failed API call isn’t new permission.
The request says one private document, with a local save if publication fails. The proposed fallback uses a shared board instead. FlowRail flags the change of audience before Claude saves the code.
Founder voice clone · captions available · controlled staging recording
About the evidence in this recording
This edited staging recording shows checks on generated code, not interception of a live outgoing action. The corrected write was allowed; three requirements in that recorded run still needed service evidence, and the overall review remained blocked. The sandbox used local effects, with no delivery to real recipients.
Evidence, with its limits
A useful answer isn’t always “passed.”
A file check is part of the story. FlowRail keeps the unresolved parts visible.
×
A violation
Something in the proposed code breaks a requirement. Correct it.
Ⅱ
A check in progress
The design-bound write stays paused. Retry to collect the result.
?
Evidence still missing
“Not established” is distinct from a vulnerability or verified satisfaction.
Your next Claude Code session
Keep the momentum. Bring your requirements.
One setup guide. The same instructions for you and the agent helping you.
A connection between your design requirements and the code Claude proposes. FlowRail reviews the design, checks supported writes against applicable rules, and keeps the findings and subsequent evidence together in a review.
Does a passing check mean my app is secure?+
No. It is evidence about that check, with the context available. A requirement can remain not established, and a review can stay open after a write passes. Keep your tests, code review and other security checks.
What happens when a check takes too long?+
An incomplete design-bound check pauses the write and asks for a retry. The unchanged retry can collect the result. A pause is an operational state, not another vulnerability. Unbound writes can still proceed on operational failures under the default scoped posture.
Does FlowRail see my code?+
Yes. The specification and candidate code are sent to FlowRail and its configured model provider for analysis. Read the privacy page before supplying sensitive code.
Can OpenClaw or another agent set it up?+
An agent can read the installation guide and help you follow it. The shipped hook integration is for Claude Code. The text guide explains prerequisites, key handling, verification and uninstall without needing to interpret a video or a dashboard.