Changelog
0.1.0 - 2026-09-26
First release. Flagsweep is a self-hosted FeatureOps layer on top of the feature flags in your cloud. Your flags stay in Azure App Configuration, and Flagsweep adds what the portal lacks: an attributed audit trail, drift detection, locks, protected environments, owners, and retire-by dates.
Boolean flags only. Multi-variant flags, feature filters, AWS AppConfig, and a hosted edition are planned.
Connect
- A connection is one Azure App Configuration store, reached with its access-key connection string.
- Environments map to Azure labels, in an order you choose.
- Connection strings are encrypted with AES-256-GCM when you provide a secret key, with key rotation and startup validation. Without a key they are stored in plain text.
Flags
- The flag list has one row per flag, with a rollout strip that shows every environment and switches it.
- Each flag has a page where you toggle it, add it to environments that lack it, lock it, edit it, and delete it across all environments at once.
- Every flag has an owner, which any member can assign. The dashboard's My flags card lists yours.
- Every flag gets a retire-by date, 90 days out by default, unless you mark it permanent.
- Status badges, with a matching filter, mark flags that are Out of sync, Drift, Locked, Overdue, Retiring soon, or Owner deleted.
Govern
- The audit trail records who changed which flag, in which environment, when, and the old and new values. It can be filtered, and entries survive the removal of the user.
- Drift marks a flag switched differently from the baseline environment.
- Out of sync marks a flag changed outside Flagsweep: in the portal, the CLI, or a pipeline.
- An admin or the flag's owner can lock a flag, which makes it read-only in Azure itself.
- In a protected environment only admins can change flags, and every toggle asks for confirmation.
Team
- There are two roles, Admin and Member. The first account becomes the admin.
- Admins invite users by link, change roles, reset passwords, and remove users.
- Re-inviting a removed user's email restores the account with its audit history intact.
- The password policy is configurable.
Run it
- One Docker image for
linux/amd64andlinux/arm64atghcr.io/flagsweep-hq/flagsweep, with build provenance. It runs as an unprivileged user. - All state lives in one directory: a SQLite database and its key ring.
- The image is set up to run behind a reverse proxy that terminates TLS, and sends security headers on every response.
GET /healthreports status, version, uptime, and database connectivity.- Sandbox mode (
--sandbox --seed) lets you try it without an Azure account. - The documentation site covers installation, configuration, and a guide per feature.