User Guide
Complete reference for Product Admins and team members -- product configuration, the Analyze tab in depth, and all ten SDLC workflow tabs.
1. Overview & Enterprise vs Evaluation
FlowSquad Enterprise is an AI-powered SDLC intelligence platform that transforms the way engineering teams produce and maintain software development artifacts. By connecting your codebase, documentation, and project tools into a single workspace, FlowSquad enables you to generate requirements, epics, user stories, tasks, solution designs, and test cases -- all grounded in your actual product knowledge.
FlowSquad ships with ten fully operational workflow tabs: Analyze, Refine, Epic, Story, Task, Design, Test Cases, Quality Score, Security Scan, and AskProduct. Every tab is production-ready and designed to support real engineering teams working at scale.
Enterprise vs Evaluation
| Feature |
Evaluation (30 days, 1 product) |
Enterprise |
| All workflow tabs | ✓ | ✓ |
| Multi-product workspaces | 1 product | ✓ Unlimited |
| User accounts & team members | Single user | ✓ Full RBAC |
| LDAP / Active Directory SSO | -- | ✓ |
| SAML 2.0 SSO | -- | ✓ |
| OAuth2 social login | -- | ✓ |
| Multi-factor authentication (MFA) | -- | ✓ TOTP & Email OTP |
| Per-product LLM provider config | -- | ✓ |
| Jira integration (push artifacts) | -- | ✓ |
| Confluence integration | -- | ✓ |
| Database encryption at rest | -- | ✓ |
| Audit logging | -- | ✓ |
| PostgreSQL / MySQL support | Single-user database | ✓ |
| Kubernetes / Docker deployment | -- | ✓ |
| License management | -- | ✓ |
| Priority support | -- | ✓ |
💡
Getting the most from FlowSquad
Start in the Analyze tab to load your codebase and documentation. All downstream tabs -- Refine, Epic, Story, Task, Design, Test Cases, Quality Score, Security Scan, and AskProduct -- draw from the knowledge base built there.
2. Part A -- Product Admin
ℹ️
This section is for Product Admins
Product Admins have full control within their assigned products: team management, LLM configuration per tab, artifact deletion, and integration overrides. Regular Users should skip to
Part B -- Analyze Tab.
Your Dashboard
After login, the FlowSquad dashboard shows all products you have access to. Product Admins see a gear icon on their products linking directly to Product Settings.
Product Configuration
Navigate to your product -> Settings. As a Product Admin you can change:
- Product name, description, and logo
- LLM model per tab -- assign different AI models to each of the 10 operations. Example: use GPT-4o for Design (high quality, low volume) and GPT-4o-mini for Refine (high volume, cost efficiency). See the LLM Configuration table below.
- Jira project key override -- override the global Jira project for this product specifically
- Danger Zone -- archive or permanently delete the product
Configuring LLM per Tab
Navigate to Product -> Settings -> LLM Configuration. For each operation select a provider and model:
| Operation | Description | Recommended Model |
|---|
| Analyze | Codebase parsing and indexing | GPT-4o-mini (high volume) |
| Refine | Requirement refinement | GPT-4o-mini or Claude 3 Haiku |
| Epic | Epic generation | GPT-4o-mini |
| Story | User story generation | GPT-4o-mini |
| Task | Task breakdown | GPT-4o-mini |
| Design | Solution design generation | GPT-4o or Claude 3.5 Sonnet (complex reasoning) |
| Test Cases | Test case generation | GPT-4o-mini |
| Quality | Quality scoring | GPT-4o (Deep Scan) / GPT-4o-mini (Quick Scan) |
| Security Scan | OWASP vulnerability analysis | GPT-4o |
| AskProduct | Q&A over knowledge base | GPT-4o-mini |
Managing Team Members
Navigate to Product -> Manage Users:
- Add member: Search by name or email -> assign role (Regular User or Product Admin) -> Add
- Change role: Click user row -> change role -> Save
- Remove member: Click user row -> Remove from Product
- Add co-admin: Assign the Product Admin role to another user. There is no limit on the number of Product Admins per product.
Deleting Artifacts (Product Admin Only)
Product Admins can permanently delete any artifact from the database. Regular Users cannot delete -- they can only remove artifacts from their current session.
- In any tab, open the View All [Artifacts] in Database panel
- Select the artifact(s) to delete
- Click Delete from Database -- this is permanent and cannot be undone
⚠️
Deletions are permanent
Artifacts deleted from the database cannot be recovered. Use the session-level remove action if you only want to clear an artifact from the current working context -- this does not affect the database.
Product Roles -- What Each Can Do
ℹ
Tabs are available once the product has been analyzed
All 10 workflow tabs are visible to Regular Users, but generation in most tabs requires that a Product Admin (or Global Admin) has first run the Analyze step to build the product knowledge base. Before analysis, tabs will show a prompt to load a codebase.
| Action | Regular User | Product Admin | Global Admin |
|---|
| Use all 10 workflow tabs | ✓ | ✓ | ✓ |
| Generate & save artifacts to DB | ✓ | ✓ | ✓ |
| Push to Jira / Confluence | ✓ | ✓ | ✓ |
| Delete artifacts from DB | -- | ✓ | ✓ |
| Manage team members | -- | ✓ | ✓ |
| Configure LLM per tab | -- | ✓ | ✓ |
| Edit product settings | -- | ✓ | ✓ |
| Run Analyze (load codebase) | -- | ✓ | ✓ |
| Delete the product | -- | -- | ✓ |
| Access Admin Panel | -- | -- | ✓ |
3. Part B — The Analyze Tab (In Depth)
⚠️
Product Admin action required before Regular Users can generate
The Analyze tab must be set up by a Product Admin or Global Admin first. Until at least one codebase has been loaded and analyzed, all downstream tabs (Refine, Epic, Story, Task, Design, Test Cases, Quality Score, Security Scan, AskProduct) display a “Please analyze the product first” warning and generation is blocked. Once analysis is complete the knowledge base is persistent — Regular Users can generate freely without re-analyzing.
The Analyze tab is divided into four sections: Product Codebases, Test Case Management, QA Automation Frameworks, and Product Documents.
Section 1 — Product Codebases
A product can have multiple codebases (backend API, React frontend, mobile app, microservices, etc.). Click ＋ Add Codebase to open the codebase dialog.
Codebase Input Methods
Two source types are available. Select the radio button that matches your setup:
| Method | When to Use | Example |
|---|
| 📁 Local Path |
The codebase directory is accessible on the same host as FlowSquad. Use the full absolute path on disk. |
Windows installer: C:\Projects\MyApp\backend
Docker: copy code in first — docker cp /local/path flowsquad-app:/data/my-codebase — then use path /data/my-codebase |
| 🔗 Clone from Git |
Clone directly from any Git server: GitHub, GitLab, Bitbucket, Azure DevOps, Gitea, self-hosted, etc. FlowSquad clones the repository on first Analyze and stores only the analysis index — the original Git URL is preserved permanently. |
Git URL + username + password or Personal Access Token. Source control credentials from Setup Wizard Step 5 are pre-filled if configured. |
💡
Git credentials are session-only
Git credentials are never written to the database. They are stored in your browser session and are required on first Analyze and again after session expiry. On Refresh, FlowSquad prompts for credentials if they are no longer in session.
Analysis Configuration — Budget
Expand ⚙️ Analysis Configuration in the codebase dialog to set the LLM spend cap. The default of $3.00 covers most small-to-medium codebases. Raise it for large monorepos or lower it to limit cost during trial. Range: $0.50–$50.
Before every LLM call, FlowSquad checks the accumulated cost. If it has reached the budget, the remaining files are skipped and the analysis completes with the files already processed. Increasing budget after a partial analysis and clicking Re-analyze will resume from scratch with the higher cap.
Analysis Configuration — Exclude File Types
Four pre-built exclusion rules are provided as checkboxes, all enabled by default. Unchecking a rule includes those files back into analysis.
| Checkbox | Files Skipped | Recommended |
|---|
| Test Files | test/, *_test.*, *Test.*, *Spec.* | ✓ Leave on — focuses analysis on production code |
| Configuration Files | *.json, *.xml, *.yml, *.ini, *.properties | ✓ Leave on — config rarely contains business logic |
| Build Files | Makefile, *.gradle, pom.xml, CMake* | ✓ Leave on — build scripts add noise, not insight |
| Generated / Migration Files | migrations/, generated/, dist/, build/ | ✓ Leave on — generated code inflates LLM cost with no benefit |
Analysis Configuration — Custom Exclude Folders
Enter a comma-separated list of folder names to skip entirely. FlowSquad matches against the folder name anywhere in the path — you do not need to specify a full path.
Examples:
docs, Installers, License-tools — skip documentation and packaging folders.venv, tests, fixtures — skip a virtual environment and test datalegacy, deprecated, archive — skip old code that is no longer active
Folder names are matched case-sensitively on Linux/Docker and case-insensitively on Windows. Use the exact folder name as it appears on disk.
Analysis Configuration — Custom Exclude File Types
Enter a comma-separated list of file suffixes or exact filenames to skip. Both glob-style suffixes and exact filenames are supported.
Examples:
*.md — skip all Markdown files__init__.py — skip Python package init files (usually empty)*.min.js, *.bundle.js — skip minified/bundled JavaScript*.pb.go, *_generated.py — skip protobuf-generated files
Analysis Configuration — System Directory Exclusions
FlowSquad automatically skips a curated set of well-known system and tooling directories that never contain meaningful business logic. These are displayed as checkboxes in the 📁 System Directory Exclusions section, all pre-checked. You can uncheck any entry to include it in analysis if your project genuinely stores source code there.
| Group | Directories Excluded |
|---|
| Version Control | .git, .svn, .hg |
| Python Tooling | __pycache__, .tox, .mypy_cache, .pytest_cache, .ruff_cache |
| Virtual Environments | venv, .venv, env, .env, site-packages |
| JavaScript / Node | node_modules, .npm, .yarn, .pnp |
| JVM Build Output | target, .gradle, .m2 |
| .NET Build Output | bin, obj, packages |
| IDE Metadata | .idea, .vscode, .eclipse |
| CI / Infra | .github, .gitlab, .circleci, .terraform |
| Coverage / Reports | coverage, .coverage, htmlcov, reports |
| AI / Vector Tools | .bob, .cursor, chroma, chromadb |
These exclusions are applied before any file is read or scored, so they save both time and LLM cost. The pre-checked state is saved per codebase, so your customisations persist across re-analyses.
Analysis Configuration — Analyse All Files
The 📋 Analyse all files checkbox bypasses the priority scoring algorithm. When checked:
- All files that survive the exclusion filters are sent to the LLM in filesystem discovery order, not ranked order.
- The LLM budget cap still applies — analysis stops when the budget is reached, regardless of how many files remain.
- The Priority Weights section is greyed out (not used).
Use this mode when you want to guarantee that every file is considered (e.g. a small codebase where all files matter, or when priority ranking produces unexpected results). For large codebases, leaving this off and using priority weights is more cost-effective.
Analysis Configuration — Priority Weights
When Analyse all files is off, FlowSquad scores every file before selecting which ones to send to the LLM. Each file accumulates points based on its characteristics:
| Characteristic | Condition | Default Points | What it means |
|---|
| 🎯 Entry Point |
File is detected as a main program, command handler, app entrypoint, or route registration file |
100 |
These files define what the application does at a high level — highest priority |
| 📄 High LOC |
File has more lines of code than the Min LOC Threshold |
50 |
Larger files tend to contain more logic worth understanding semantically |
| 🔗 High Dependencies |
File is imported by many other files (a hub module) |
30 |
Hub modules affect many parts of the system — understanding them has high leverage |
| 🧰 High Complexity |
File has many decision points (cyclomatic complexity) |
40 |
Complex files are more likely to contain nuanced business logic |
| 📏 Min LOC Threshold |
Lines of code threshold for “High LOC” classification |
500 |
Files below this line count do not qualify for the High LOC bonus |
Scoring example: A file that is both an entry point (100) and exceeds the LOC threshold (50) and is imported by 20 other files (30) scores 180 points and is ranked near the top of the LLM selection list.
You can raise or lower individual weights to tune the selection for your codebase. For example, if your project has many thin entry points but business logic lives in service files, reducing the Entry Point weight and raising High Complexity will shift focus to the right files.
Click 🔄 Reset All to Defaults to restore factory values.
Pre-Analysis Preview
Before any LLM calls are made, FlowSquad shows a Pre-Analysis Preview modal when you click Analyze. This gives you a full breakdown of what will happen:
| Row | What it shows |
|---|
| Total files discovered | All files found in the codebase directory (before any filters) |
| After system dir exclusions | Files remaining after removing node_modules, .git, venv, etc. |
| After rule-based exclusions | Files remaining after applying test/config/build/migration/custom rules |
| After priority filtering | Files with a priority score above zero (or all files if “Analyse all files” is on) |
| Files for LLM (estimated) | The final count that will be sent for semantic analysis, capped by your budget |
| Estimated cost | Approximate LLM spend based on average file size and your configured model |
If the preview shows fewer files than expected, check your exclusion settings and adjust before proceeding. Click Proceed with Analysis to start, or Review Config to go back and change settings.
Managing Existing Codebases
- Edit — click the pencil icon on a codebase card to update name, path, Git credentials, or any analysis configuration. Editing metadata alone does not trigger re-analysis.
- Analyze — runs the full analysis pipeline. Shows the Pre-Analysis Preview before committing to LLM cost.
- Refresh (↻) — incremental update. For Git codebases, FlowSquad fetches the latest commits first, then runs analysis only on files that changed since the last analysis. For local codebases, it compares file checksums directly. Much faster and cheaper than a full re-analysis.
- Re-analyze — full fresh analysis from scratch. Use this after major structural refactors or after changing the LLM model in product settings. Deletes the previous index and rebuilds it entirely.
- Delete (Product Admin only) — permanently removes the codebase index from the vector database. The source code itself is never stored by FlowSquad — only the analysis index is deleted.
How Analysis Works
FlowSquad performs five passes over the codebase. All exclusion rules are applied in Pass 1, so excluded files never consume any compute or LLM budget:
- Discovery & Exclusion — walks the directory tree, applies system dir exclusions, rule-based exclusions (test/config/build/migration), custom folder exclusions, and custom filetype exclusions. Only the surviving files proceed.
- Structural parse (tree-sitter) — extracts function signatures, class definitions, imports, and module boundaries from all surviving files. Language-agnostic and very fast. Produces complexity scores, dependency counts, and layer classifications (UI / API / Service / Data / Utility).
- Priority scoring & file selection — scores each file using the configured priority weights (or skips scoring if “Analyse all files” is on) and selects the highest-value files within the LLM budget estimate.
- Semantic analysis (LLM) — reads the selected files to understand intent, business logic, data flows, and API contracts. This is where LLM cost is incurred, capped by your budget. Each file is checked against the budget before the call is made.
- Vector indexing (ChromaDB) — embeds all extracted knowledge as vectors in the product knowledge base. All downstream tabs query this index at generation time.
The resulting knowledge is persistent — it survives page reloads and restarts. You only need to Refresh or Re-analyze when the codebase changes.
Section 2 — Test Case Management
Manage test cases for the product. These are used in the Quality Score tab for coverage calculations. Three ways to add test cases:
| Method | Description |
|---|
| ＋ Add Test Case | Manually enter a single test case with name, description, module, and link to a codebase or automation framework. |
| 📊 Import from Excel | Bulk import from an .xlsx file. Download the template from the import dialog for the required column layout. One row per test case. |
| 🔗 Import from Jira | Import test cases using a JQL query. Visible only when Jira integration is configured in Setup Wizard Step 6. Example: project = ENG AND issuetype = "Test". |
Each test case can be linked to a specific codebase (for unit/integration tests) or an automation framework (for E2E tests). Imported test cases appear in the Test Cases list with tracking for status, priority, and metrics.
Section 3 — QA Automation Frameworks
Track the automated test frameworks your project uses. FlowSquad uses these to identify automation scripts and calculate the Automation Coverage score in the Quality Score tab.
Click ＋ Add Automation Framework and provide:
- Framework Name — descriptive label (e.g. “Web UI Automation”, “API Test Suite”)
- Automation Type — Web UI, API, Mobile, Performance, Security, E2E, Integration, or Unit
- Source — Git Repository (clone URL + credentials) or Local Folder (absolute path)
Multiple frameworks can be registered per product (e.g. Playwright for UI + Pytest for API). Each framework supports the same full Analysis Configuration panel as a production codebase, including custom excludes, system dir exclusions, and priority weights.
Section 4 — Product Documents
Upload supporting documents into the product knowledge base. These are indexed alongside the codebase and are available to all AI generation tabs and AskProduct queries.
| Method | Supported Formats | Typical Use |
|---|
| ＋ Upload Document | PDF, DOCX, TXT, MD | Requirements specs, architecture docs, API references, runbooks |
| 🔗 Import from Confluence | Confluence page URL or page ID | Import any Confluence page directly — requires Confluence integration configured in Setup Wizard Step 6 |
To remove a document, click the trash icon on the document row.
💡
Analyze once, use everywhere
FlowSquad's core promise: load your codebase and documents once per release cycle. All downstream tabs — Refine, Epic, Story, Task, Design, Test Cases, Quality Score, Security Scan, and AskProduct — draw from this shared knowledge base at no additional analysis cost.
ℹ
Multiple input sources — available on every generation tab
Each generation tab (Refine, Epic, Story, Task, Design, Test Cases, Security Scan) has a
Smart Import panel at the top. You can combine any of the following sources in a single generation request:
- ✍️ Manual Text Input — paste or type any free-form text
- 📄 Upload Document —
.doc, .docx, .pdf, or .txt
- Jira ticket import — enter a ticket ID to pull description & acceptance criteria (visible only when Jira is configured)
- Confluence page import — enter a page ID or URL (visible only when Confluence is configured)
- Session artifacts from prior tabs — e.g. “Use Requirement from Refine Tab”, “Use Epics from Epics Tab”, “Use Stories from Stories Tab”, etc. Only options that have data in the current session are shown.
An
Additional Context text box below the sources lets you add clarifications or instructions that apply across all selected inputs.
4. The Refine Tab
The Refine tab transforms raw, unstructured requirements into clean, structured, AI-refined requirement statements. This is typically the first generation step after loading your codebase in the Analyze tab.
⚠️
Requires analyzed product
If the Analyze tab has not been set up by a Product Admin, this tab displays a “Please analyze the product first” warning and generation is disabled.
Providing Input
Use the Smart Import panel to select one or more input sources (Manual Text, Upload Document, Jira, Confluence). All selected sources are combined and sent to the AI together. Click Generate once your sources are selected.
Generating Refined Requirements
FlowSquad's AI analyzes the input in the context of your loaded codebase and documents, removes ambiguity, resolves conflicts, and produces structured requirement statements with clarification questions. Answer all questions, then click Generate Refined Requirement.
Saving Requirements
| Action | Effect |
|---|
| Save to Session |
Makes the refined requirements available to all other tabs in the current session (Epic, Story, Task, Design, Test Cases). Requirements are held in memory and do not persist after logout. |
| Save to DB |
Persists the refined requirements to the database permanently. They will be available in future sessions under View All in Database on the Refine tab. |
| Remove from Session |
Clears the currently loaded requirements from the session without deleting database records. Use this to load a different set of requirements in the same session. |
💡
Save to Session before generating epics
Always click Save to Session after generating refined requirements. The Epic tab reads requirements from the session -- without this step, the AI will not have access to your latest requirements when generating epics.
7. The Epic Tab
The Epic tab generates high-level work packages (epics) from your refined requirements. Epics represent major areas of functionality that will be broken down into stories in the next tab.
Generating Epics
Ensure refined requirements are loaded in the session (use Save to Session in the Refine tab first). Click Generate Epics. FlowSquad produces a set of epics grounded in your requirements and codebase context.
IT vs Non-IT Card View
Generated epics are displayed as cards in two tabs: IT (technical epics related to software development, infrastructure, or integrations) and Non-IT (business process, compliance, or documentation epics). Use the tab switcher to navigate between views.
Per-Card Actions
Each epic card provides the following actions:
- View -- Open the full epic detail in a modal.
- Edit -- Edit the epic title, description, and acceptance criteria inline.
- Delete -- Remove the epic from the current view.
- Push to Jira -- Create a Jira epic directly from this card using your configured Jira integration.
- Download -- Download this epic as a Word document.
- Save to Session -- Add this epic to the current session so it is available for story generation.
- Save to DB -- Persist this epic to the database permanently.
- Distribute -- Split this epic into multiple smaller epics.
- Merge -- Combine this epic with one or more other epics into a single epic.
Bulk Actions
The bulk action bar appears when you select one or more cards using the checkbox in the top-left corner of each card. Bulk actions available: Select All, Bulk Save to Session, Bulk Save to DB, and Bulk Export (downloads all selected epics as a single Excel file).
View All Panels
At the bottom of the tab, two buttons provide access to persisted epics:
- View All Epics in Session -- Displays all epics currently held in the session.
- View All Epics in Database -- Displays all epics saved to the database for this product. From here you can load epics back into the session or delete them (Product Admins only).
8. The Story Tab
The Story tab breaks epics down into individual user stories -- discrete, user-facing requirements with clear acceptance criteria. Stories follow the same card-based interface as epics.
Generating Stories
Stories can be generated from two sources:
- From epics in session -- The primary path. Ensure epics are saved to the session in the Epic tab, then click Generate Stories.
- From refined requirements directly -- If you prefer to skip epics, FlowSquad can generate stories directly from requirements in the session.
IT vs Non-IT Card View
Same as the Epic tab -- generated stories are categorized as IT or Non-IT and displayed in separate tabs.
Per-Card Actions
Each story card offers: View, Edit, Delete, Push to Jira (creates a Jira Story issue), Download (Word), Save to Session, Save to DB, Distribute (split story into sub-stories), and Merge (combine stories).
Bulk Actions & Proceed
The bulk action bar mirrors the Epic tab. Click Proceed at the bottom of the tab to navigate directly to the Task tab with the current session context intact.
9. The Task Tab
The Task tab decomposes user stories into granular, assignable tasks -- the individual units of work for developers. Tasks follow the same card-based interface as epics and stories.
Generating Tasks
Ensure stories are saved to the session in the Story tab, then click Generate Tasks. FlowSquad produces implementation-level tasks, including technical details drawn from your loaded codebase.
IT vs Non-IT Card View
Tasks are categorized as IT or Non-IT, displayed in separate views.
Per-Card Actions
Each task card provides 9 actions: View, Edit, Delete, Push to Jira (creates a Jira Task issue), Download (Word), Save to Session, Save to DB, Distribute, and Merge.
Bulk Actions
The bulk action bar provides: Select All, Bulk Save to Session, Bulk Save to DB, Bulk Export, and Download Excel -- exports all tasks in the current view to a structured Excel workbook. This Excel export is formatted for direct import into project management tools.
💡
Download Excel for sprint planning
Use the Download Excel button to export your full task list into a spreadsheet. This is useful for sprint planning sessions where stakeholders prefer to work in Excel before tasks are created in Jira.
10. The Design Tab
The Design tab generates a comprehensive Solution Design Document from your refined requirements and codebase context. The design document describes the proposed architecture, component interactions, data flows, and technical decisions in a format suitable for technical review and stakeholder sign-off.
Generating a Design -- Two-Step Flow
Design generation uses a two-step process to produce more accurate and contextually grounded documents:
- Step 1 -- Technical Questions: Click Generate Technical Questions. FlowSquad queries your analyzed codebase and asks the LLM to produce 5-8 architect-level clarification questions about the requirement. Review these questions -- they highlight ambiguous or under-specified areas that would affect the design.
- Step 2 -- Design Document: Answer the technical questions (or skip them) and click Generate Design. FlowSquad uses both the requirement and your question answers to produce a structured design document grounded in your codebase architecture.
You can skip Step 1 and click Generate Design directly from a requirement -- the technical questions step is optional but produces better results when requirements are complex or loosely defined.
Design Actions
- Save to DB -- Persist the design document to the database. Future sessions can retrieve it from View All Designs in Database.
- Push to Jira -- Create a Jira ticket containing the design document. The ticket is linked to your configured Jira project.
- Push to Confluence -- Publish the design document as a Confluence page in your configured space. The page is created with proper headings and formatted for readability.
- Download as Word -- Export the design document as a Word-compatible
.doc file for distribution or offline editing.
💡
Design feeds Test Cases
After saving a design to the session or database, the Test Cases tab can use it as a source for generating test cases. A design-driven approach typically produces more comprehensive test coverage than requirements-only generation.
11. The Test Cases Tab
The Test Cases tab generates a comprehensive suite of test cases from your design document or refined requirements. Test cases are displayed as cards and can be saved, exported, and pushed to Jira.
Generating Test Cases
Two generation sources are available:
- From design document -- Preferred. Generates test cases aligned with the solution design, covering component interfaces, edge cases, and integration points.
- From refined requirements -- Generates functional test cases directly from requirements statements.
Click Generate Test Cases after selecting the source.
Per-Card Actions
Each test case card provides: View (full test case detail in modal), Delete, Save to Session, and Save to DB.
Bulk Actions & Export
The bulk action bar provides: Select All, Bulk Save to Session, Bulk Save to DB, Download Excel (exports all selected test cases to a structured Excel workbook), and Proceed (navigates to the Quality Score tab).
View All Panels
- View All Test Cases in Session -- Shows all test cases in the current session.
- View All Test Cases in Database -- Shows all test cases saved to the database for this product.
12. The Quality Score Tab
The Quality Score tab provides an objective, multi-dimensional measurement of your product's test quality. It combines structural analysis of your codebase with semantic analysis of your test cases to produce an actionable score.
⚠️
Prerequisites
Before running a quality scan, ensure that: (1) a codebase is loaded in the Analyze tab, and (2) test cases have been imported or generated and saved to the session or database.
Scoring Model
The Quality Score is calculated across three layers, with a maximum total of 100 points:
| Layer | Max Points | What It Measures |
|---|
| Layer 1 -- Test Density / Semantic Coverage |
60 pts |
How thoroughly your test cases cover the codebase. Two scan modes available. |
| Layer 2 -- Automation Coverage |
30 pts |
The ratio of automated test scripts to total test cases. |
| Layer 3 -- Bonus |
10 pts |
Awarded when both Layer 1 and Layer 2 scores exceed 80%. |
Layer 1 Scan Modes
- Quick Scan -- Calculates test density using the ratio of test cases to code modules. Fast (typically seconds) and suitable for a high-level coverage baseline. Does not verify that individual functions are tested.
- Deep Scan -- Uses AI to verify per-function test coverage. Reads each function in the codebase and determines whether a corresponding test case exists. Slower (minutes for large codebases) but produces a precise semantic coverage percentage.
Layer 2 -- Automation Coverage
FlowSquad counts the automated test scripts identified in your codebase (using the QA framework specified in the Analyze tab) and divides by the total number of test cases imported or generated. This ratio is scaled to the 30-point maximum.
Score Bands
| Score Range | Band | Recommended Action |
|---|
| 90 – 100 | ✓ Excellent | Maintain current coverage discipline. |
| 80 – 89 | ✓ Good | Minor gaps remain; target specific low-coverage modules. |
| 70 – 79 | ⚠ Fair | Coverage is acceptable but improvement is recommended before release. |
| 60 – 69 | ● Poor | Significant untested areas; prioritize test case authoring for high-risk modules. |
| < 60 | ✗ Critical | Coverage is insufficient. Do not ship until coverage is improved. |
💡
Use Deep Scan for release gates
For release readiness decisions, always run a Deep Scan. The Quick Scan is useful during development sprints for a fast feedback loop, but only Deep Scan confirms that individual functions are actually covered by test cases.
13. The Security Scan Tab
The Security Scan tab performs an automated vulnerability analysis of your loaded codebase against the OWASP Top 10 -- the industry-standard list of the most critical web application security risks. No additional configuration is required beyond having a codebase loaded in the Analyze tab.
How It Works
FlowSquad's AI security scanner reads your codebase and identifies patterns associated with common vulnerability categories. The scan checks for:
- SQL injection and NoSQL injection vulnerabilities
- Cross-site scripting (XSS) risks
- Authentication and session management flaws
- Insecure direct object references
- Security misconfiguration patterns
- Sensitive data exposure (e.g., hardcoded credentials, unencrypted secrets)
- XML External Entity (XXE) processing risks
- Broken access control patterns
- Use of components with known vulnerabilities
- Insufficient logging and monitoring indicators
Running a Scan
Ensure a codebase is loaded in the Analyze tab. Navigate to the Security Scan tab and click Run Security Scan. The scan typically completes in 1-5 minutes depending on codebase size. Results are displayed as a vulnerability report with findings grouped by OWASP category, severity level, and affected file.
Viewing and Exporting Results
Each finding includes: the vulnerability category, affected file and line number (where applicable), a description of the risk, and a recommended remediation. Click Export Report to download the full vulnerability report as an Excel file suitable for security review meetings or compliance documentation.
⚠️
AI-assisted analysis
The Security Scan provides AI-assisted pattern analysis. It is a development-time aid to highlight areas for review -- it does not replace a formal security audit or penetration test. Always validate findings with your security team before making remediation decisions.
14. The AskProduct Tab
The AskProduct tab is a conversational AI interface that lets you ask free-text questions about your product. FlowSquad searches across your entire loaded knowledge base -- codebase, uploaded documents, and generated artifacts -- and provides a precise answer with source references.
Asking Questions
Type a question in natural language into the chat input and press Enter or click Send. FlowSquad uses retrieval-augmented generation (RAG) to find the most relevant sections of your knowledge base and constructs an answer grounded in that content.
Example questions you can ask:
- "What authentication methods does this product support?"
- "Which modules handle payment processing?"
- "What are the main API endpoints for user management?"
- "Does this product currently implement rate limiting?"
- "What does the requirements document say about offline mode?"
Chat History
Conversation history is maintained for the duration of your session, allowing follow-up questions and multi-turn conversations. The AI has context from previous turns in the same conversation. Chat history is cleared when you log out or start a new session.
Knowledge Sources
AskProduct searches across four distinct knowledge collections simultaneously:
- Codebase -- Architecture, APIs, functions, and module relationships from your analyzed codebase.
- Documents -- Requirements, specifications, and any uploaded supporting files.
- Test Cases -- All test scenarios imported or generated for this product.
- Automation -- Test scripts and automation framework analysis from your QA codebase.
The Knowledge Sources panel on the right side of the AskProduct tab shows all data currently indexed for this product. If a source is missing, return to the Analyze tab to load it before asking questions about that area.
💡
No extra setup needed
AskProduct uses the same knowledge base built in the Analyze tab. Load your codebase and documents once, and AskProduct is ready to use immediately -- no separate indexing step or vector store configuration required.
15. Session & Database Workflow
Understanding how FlowSquad manages data across sessions is essential for effective use of the platform. FlowSquad uses a two-tier data model: Session (temporary, in-memory) and Database (permanent, persisted).
How Artifacts Flow Through the Workflow
- Analyze tab loads data -- Codebase, documents, and test cases are indexed and become available as context for all generation steps.
- Generate artifacts -- In each tab (Refine, Epic, Story, Task, Design, Test Cases), click Generate to produce artifacts. Generated artifacts exist in the current view but are not yet persisted.
- Save to Session -- Click Save to Session on individual artifacts or use bulk save. Artifacts saved to the session are available across all tabs in the current session. The session persists until you log out.
- Save to DB -- Click Save to DB to permanently persist artifacts to the database. These artifacts will be available in all future sessions for this product.
Loading from Database into a New Session
When you start a new session, previously generated artifacts are not automatically loaded. To resume work from a prior session:
- In each tab, click View All [Artifacts] in Database
- Select the artifacts you want to use in the current session
- Click Load to Session -- the selected artifacts are added to your session context and become available for the next generation step
The Proceed Button Chain
The Proceed button at the bottom of each tab navigates to the next tab in the workflow sequence: Refine -> Epic -> Story -> Task -> Design -> Test Cases -> Quality Score. Clicking Proceed does not automatically save artifacts -- ensure you have saved to session or database before proceeding if you want to use the current artifacts in the next tab.
ℹ️
Session timeout
Sessions expire after the inactivity timeout configured by your administrator (default: 8 hours). Unsaved session data is lost on timeout. Save important artifacts to the database during long working sessions to avoid data loss.
16. Exporting & Integrations
FlowSquad provides multiple export and integration options to move generated artifacts into your existing toolchain.
Download Formats
| Format | Available From | Contents |
|---|
| Word (.doc) |
Design tab, individual artifact cards (Epic, Story, Task) |
Formatted document suitable for review and distribution. |
| Excel (.xlsx) |
Task tab (Download Excel), Test Cases tab (Download Excel) |
Structured workbook with one row per artifact, all fields as columns. |
| CSV |
Test Cases bulk export |
Comma-separated test cases for import into test management tools. |
Push to Jira
Jira integration is available from individual artifact cards (Epics, Stories, Tasks, Designs) and from the bulk action bar. When you click Push to Jira:
- FlowSquad creates a Jira issue of the appropriate type (Epic, Story, Task, or generic issue for Designs) in your configured Jira project.
- The issue title, description, and acceptance criteria are populated from the FlowSquad artifact.
- A link to the newly created Jira issue is shown in the card for confirmation.
- If Jira Push fails (e.g., due to permissions or field validation), an error message is shown with the reason from Jira's API.
ℹ️
Jira project configuration
The target Jira project is set in Admin > Integrations > Jira. Product Admins can override the default project per product in Product Settings > Integrations.
Push to Confluence
The Design tab provides a Push to Confluence action. FlowSquad creates a new Confluence page in your configured space using the design document content. The page is formatted with proper headings, sections, and a title derived from the design artifact name. The Confluence page URL is displayed after a successful push.
💡
Combine export formats for stakeholder reviews
For release planning, push epics and stories to Jira for the engineering team, push the design document to Confluence for the architecture review, and download the test case Excel for the QA team -- all from a single FlowSquad session.
Troubleshooting: Tab & UI Issues
AI Generation Returns No Results or Empty Output
Common causes and fixes:
- No codebase loaded: Return to the Analyze tab and load your codebase before using generation tabs.
- Nothing saved to session: In each tab, generated artifacts must be explicitly saved to Session or DB. Check that the previous tab's artifacts were saved to session before generating the next level (e.g., requirements must be in session before generating epics).
- LLM API key expired or rate-limited: Ask your Product Admin or Global Admin to check Admin Panel -> LLM Configuration -> Test Connection.
Jira Push Fails -- "401 Unauthorized"
The Jira API token has expired or is invalid.
- Go to id.atlassian.com -> API tokens
- Create a new token named "FlowSquad Production"
- Update it in Admin Panel -> Settings -> Jira -> API Token -> Test Connection -> Save
Also verify you are using your email address (not just username) and that the Jira type is set correctly (Cloud vs. Server).
GitHub "Repository Not Found" for Private Repo
- Verify the PAT has the
repo scope: github.com/settings/tokens -> edit token -> enable "repo"
- If your organisation enforces SAML SSO: go to the token settings -> Configure SSO -> Authorize next to your organisation
- Update the token in Admin Panel -> Settings -> Source Control -> Test Connection
Quality Score Tab -- "No test cases loaded"
Import or generate test cases in the Analyze tab or Test Cases tab and save them to the Session or Database before running the Quality Score scan.
AskProduct Returns "I don't have information about this"
- The knowledge base may be incomplete. Return to the Analyze tab and verify a codebase and relevant documents are loaded.
- Rephrase the question more specifically -- AskProduct performs best with targeted questions about specific features, APIs, or modules.
- If documents were recently added, wait 30 seconds for indexing to complete before querying.
Session Data Lost After Page Refresh
Session data (artifacts not yet saved to DB) is held in memory. A full page refresh or session timeout clears it. Always click Save to DB for artifacts you want to keep. The default session timeout is 8 hours of inactivity (configurable by your admin).