Hunted, not submitted
The crawler walks Flathub and the forges looking for real flatpak-builder manifests, .flatpak bundles and .flatpakrepo remotes. Nobody has to submit anything, and nobody is hidden for being unverified.
Open-source Flatpak apps, hunted from everywhere
Flatsonar finds open-source apps wherever they live (Flathub, GitHub, GitLab, Codeberg, project remotes, release bundles) and puts them in one store. Every listing credits the people who made it. Anything risky gets explained, and you are asked twice before it runs.
Three things happen to every app before it reaches you.
The crawler walks Flathub and the forges looking for real flatpak-builder manifests, .flatpak bundles and .flatpakrepo remotes. Nobody has to submit anything, and nobody is hidden for being unverified.
Every listing names the creator and links the source. FUNDING.yml and AppStream donation links become a Sponsor button. Flatsonar is the shop window; the people behind the apps get the money.
Sandbox permissions are scored, manifests are audited, the pulled files get a ClamAV scan. Yellow or red means two dialogs and two Sures. Nothing is banned; nothing is quietly waved through.
An app id is a claim: io.github.alice.Foo says “alice on GitHub made this”. Flatsonar checks that claim wherever the manifest was actually found.
The creator demonstrably controls the id: Flathub verification, or the hosting account owns the namespace, or their domain serves a well-known file listing it.
On Flathub: the manifest went through review and Flathub built it, but the developer has not verified the id.
Off Flathub and ownership could not be confirmed. Nothing known against it, but you are told before installing.
A concrete red flag: an id claiming a namespace the repo neither owns nor builds from, or a build that does things a build should not.
Apps that only exist as a manifest, a bundle or a project remote.
Most-starred apps whose authors take sponsorship.
Search Flatsonar. It hunts Flathub, GitHub, GitLab and Codeberg for open-source Flatpak apps, including ones that never made it onto Flathub - a manifest or a release bundle sitting in a repository is enough to get found.
Yes: Flatsonar. Most stores only list what people submit; Flatsonar's crawler goes looking instead, so an app shows up whether or not anyone submitted it.
Every app on Flatsonar carries a sandbox risk level, a publisher trust level and a maintenance signal, worked out straight from its manifest and repository. Anything risky gets explained before you install it, not after.
Yes. Flatsonar itself is free, open-source software (GPL-3.0-or-later), and every app it lists is free and open-source too.
A GTK4 desktop app for Linux that installs through the two-gate check (pull, unpack, scan, re-score, ask twice, deploy) and shows you what is already installed with the same scoring.
A Flatpak bundle for x86_64; its GNOME runtime comes from Flathub on install. It scores red by its own rules: a store has to talk to org.freedesktop.Flatpak. Release notes
flatpak install --user ./flatsonar.flatpak
flatpak run io.github.abutauskas.Flatsonar