Frequently asked questions

SonarQube and Semgrep read source code without running it. Flow's core differentiator is the opposite: it observes an application actually executing — real request → controller → service → database → external-call timing — and deterministically identifies which node is the real bottleneck, with confidence and evidence attached, not a static rule match.

Datadog and New Relic are always-on production observability platforms with a data pipeline you operate continuously. Flow today is on-demand: you run a scan, get a scored report, and can compare it against a previous run. It isn't a continuous monitoring replacement yet.

No. The Flow Adapter installed in your application never reads, uploads, or transmits source files — it observes execution through your framework's own event system (query events, HTTP client events, a lightweight method-timing wrapper), not by inspecting code.

Not yet as a supported, packaged product — there's no Docker image or install guide today. It's on the roadmap; until then, Flow runs as a hosted service at flow.zerethon.com.

We haven't published a specific number, because we haven't run a real benchmark yet — and we'd rather say that than guess. What we can say precisely: collection is synchronous (adds to request latency, doesn't hide behind the response), and it's disabled by default outside local/staging environments.

Not yet, and we're deliberate about that: the deterministic bottleneck-detection engine (scoring, confidence, explainability) is the actual product today, with no AI in the decision path. An optional AI layer for summarizing and explaining findings in natural language is planned, but it's designed to sit strictly downstream of the deterministic engine — it will never be allowed to decide whether a finding exists or change its severity.

No. Flow analyzes whatever URL you point it at — most teams start with staging or a public-facing page. The Adapter itself is a passive component: it never initiates outbound calls and only responds when the Engine asks it a question over HTTP.

Yes, partially — the SEO, security, structured-data, API, and AI-readiness analyzers run against any public URL with no installation required. The Runtime Trace bottleneck detection specifically needs the Flow Adapter installed to correlate a request to its real execution timing.

Not today. This is a real gap between where Flow is now and where it's headed — Runtime Trace Intelligence (the bottleneck engine) is shipped and works; a broader dependency/architecture graph is a future pillar, not a current feature. We'd rather tell you that clearly than show you a diagram that isn't real.

Source code tells you what a system is capable of doing. Runtime execution tells you what it actually did — which query really ran, which external call really dominated the request, which code path was actually hit. Flow is built around that distinction: evidence over inference.