Aug 2026
Chatwoot architecture audit
14 specialist agents and 3 independent verifiers tested an open-source help desk before a planned fork
- CRM & data
- Technical research
- Duration
- 1 month
- Company
- Epsilon Solutions
- Role
- Designed the research method and ran it
Overview
A measured audit of Chatwoot 4.16.2, the open-source help desk, made before a planned fork into Epsilon’s own omnichannel chat platform. Fourteen specialist agents tested 14 hypotheses about its architecture and security, and 3 independent verifier agents re-judged every finding.
Tools
- Docker
- PostgreSQL
- Claude Code
Evidence before a fork
Epsilon planned to fork Chatwoot into an omnichannel platform of its own, in the vein of Respond.io. Before committing, it needed evidence rather than opinion: how a code base of about 250k lines of front end and 67k lines of back end behaves at small, medium and large scale, and how secure it is.
One layer per agent
Chatwoot ran locally on Docker Compose with a seeded database. Each Claude Code agent took one layer under a brief that worked as a contract: front-end state, type safety, event dispatch, model callbacks, the enterprise overlay, ActionCable realtime, Postgres load, Sidekiq queues, container boot and the i18n bundle, plus authorization, tenant isolation, dependencies, the injection surface and live exploitability.
Checked blind
Three verifier agents that never saw the starting hypotheses re-judged every finding through three lenses: correctness, scale and alternatives. A synthesis then ranked the risks separately for each scale band and listed the limits of the method itself.
Result
The audit produced 42 findings: 31 confirmed, 8 downgraded and 3 disputed, and the agents themselves refuted 4 of the 14 starting hypotheses. The top large-scale risks were the global per-IP request throttle behind a proxy, the ActionCable worker pool during reconnect storms, and a 13.14 MB dashboard translation bundle.