Formbricks is the open source survey and experience management platform. One command on its repo: holostaff /scan.
The result: 28 routes, 13 components, 20 customer-facing copy strings, 6 coverage gaps, and 7 workflows placed on the customer journey, from Sign Up through Onboarding, Create and Edit Survey, Analyze Responses, connecting the SDK, and Billing.
Last month we published the Documenso teardown and its map became our public demo. This time we want to show a different thing: the parts of the map that could only have come from reading the code.
The map, in outline
The Formbricks map is not public like the Documenso one, so here is its outline, rebuilt from the scan artifact. Seven workflows, each placed at its journey stage:
- Sign UpCommit
- Create First Workspace & SurveyOnboard
- Connect App/Website SDKOnboard
- LoginAdopt
- Create & Edit SurveyAdopt
- Analyze ResponsesAdopt
- Billing & Plan UpgradeExpand
Risk · Login
"User forgot which auth method they used previously"
Copilot intervention
"Last time you signed in with {lastMethod}. Want to use that again?"
Risk · Analyze Responses
"Survey is live but hasn't collected responses yet"
Copilot intervention
"No responses yet? Share the survey link or connect the SDK to start collecting. Here's how to get your first response in under 5 minutes."
Workflow names, risks, and interventions quoted from the scan artifact, unedited.
Finding 1: the password breach check
Formbricks checks new passwords against the Have I Been Pwned breach corpus. No analytics tool would ever tell you this. It is invisible until the moment it rejects a password, and in that moment the user has no idea what happened.
The scan found the check in the signup flow, flagged it as a stall risk, and wrote the copilot line for it: "That password was found in a public breach." Then it suggests a passphrase instead. A user who would have bounced off a cryptic validation error gets an explanation and a way forward.
Finding 2: the login the user forgot
Classic B2B stall: you signed up with Google three weeks ago, and today you are staring at the email and password fields. The scan flagged the risk and proposed an intervention with a template variable in it: "Last time you signed in with {lastMethod}. Want to use that again?"
That variable is the interesting part. The intervention is not generic copy. It is wired to state the product actually has.
Finding 3: the SDK connection that fails silently
Connecting your app to Formbricks means pasting an SDK snippet with the right workspace ID into the right environment. The scan flagged the ways this goes wrong in practice, including content security policy blocks and initialization calls in the wrong place, and proposed a voice walkthrough for exactly that moment. Its opening line: "It looks like the SDK isn't connecting yet."
This is the kind of failure that produces a silent churn statistic. The user does not file a ticket. The integration just never finishes.
And again: silence
On the response analytics screen, the scan chose no intervention for a user scrolling through their data: "No intervention needed until they leave without taking any action." Same behavior as in the Documenso scan, where it left arriving signature recipients alone. Watching a user work is not a trigger. Watching a user give up is.
Honest limits
Same caveats as last time. The scan reads code, not production traffic, so its risks are informed hypotheses until rehearsal tests them against simulated users. Formbricks is a monorepo, and the deep pass takes longer than the 90-second skeleton. And the map reflects the repo, not any customizations a self-hosted deployment might carry.
Two products scanned. Two maps that knew the code.
Yours would be the third.
Explore the live Documenso map · or run npm install -g @holostaff/cli on your own repo.