AFFiNE: Docs and Whiteboards in One Workspace (GitHub, Scanned)

AFFiNE is a knowledge workspace that merges a document editor with an endless whiteboard. Any page can switch between a writing view and an edgeless canvas, where rich text, sticky notes, embedded web pages, multi-view databases, shapes and slides sit side by side. That makes it a single place for notes, wikis, planning boards and presentations, the job that otherwise takes Notion plus Miro.

It earns its place by being local-first. Your workspace lives on your disk and works offline, with real-time sync and collaboration added on top through AFFiNE Cloud or your own server, built on the Yjs CRDT and the team's own BlockSuite editor and OctoBase database. AFFiNE AI can draft, summarize, turn outlines into slides or mind maps and generate prototypes on the canvas.

AFFiNE is made by Toeverything, a Singapore company, and has about 73,000 stars. The licensing is split: the client and most of the code are MIT, while the server code in packages/backend carries a separate licence under which the Community Edition parts are MPL-2.0 and enterprise features need a subscription. Self-hosting the Community Edition is free.

• Repository: github.com/toeverything/AFFiNE
• Licence: custom (Other)
• Language: TypeScript. Stars: 73.2K. Forks: 5,327. Last push: Sep 30, 2026.
• Scan: safe, Sep 29, 2026, commit b71bb7c

Who it is for

Notion users who want their notes on their own disk, visual thinkers who plan on whiteboards, and small teams that want one self-hostable tool for docs and diagrams.

Getting started

1. Desktop app on macOS with Homebrew (Windows and Linux builds are on the releases page)

brew install --cask affine

2. Self-host: download the Compose file from the latest release

mkdir affine && cd affine && wget -O docker-compose.yml https://github.com/toeverything/affine/releases/latest/download/docker-compose.yml

3. Start the server with its Postgres and Redis, then open it on port 3010

docker compose up -d && open http://localhost:3010

The self-hosting guide at docs.affine.pro covers storage paths, configuration and upgrades. AI features need a model provider: on AFFiNE Cloud they are a paid plan, and on a self-hosted server you configure your own provider key. The apps send usage analytics and Sentry error reports by default; turn telemetry off in the app's settings if you prefer.

Safety scan

We cloned toeverything/AFFiNE at commit b71bb7c on Sep 29, 2026 and ran the checks described on the GitHub Tools page: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. A person read every hit. This is what we found.

• One secret hit: packages/backend/native/src/entitlement.rs line 378, a P-256 private key named TEST_PRIVATE_KEY inside the file's #[cfg(test)] module, used to sign test licence payloads. It is compiled only into tests and is not a production key. The repository is large: about 1.24 million lines in 10,273 files.
• The 13 pattern hits are long lines: base64 images in AI end-to-end test specs, inline SVG icons and tooltip illustrations, and a test fixture; none decodes and runs code. The binaries are six Yjs document snapshots used as test fixtures and the Android Gradle wrapper. The npm hooks (workspace init, Husky, prisma generate, a template build) run for developers, not users.
• Telemetry: enableTelemetry defaults to true in packages/common/infra. When it is on, the client opts into the usage tracker and enables Sentry; turning it off in settings opts out of both.
• 57 known advisories, 1 critical (22 high). The critical one is piscina 5.2.0, a dependency of the self-hosted server: a prototype-pollution gadget that needs a separate prototype-pollution bug to become code execution. The desktop app's Electron 39.8.10 has four high sandbox-related advisories, the server's nodemailer and @fastify/busboy have several more, and the Rust side has quick-xml denial-of-service issues.
• 11 workflows. One uses pull_request_target, auto-labeler, which checks out the base branch and runs actions/labeler; none of the 33 third-party actions is pinned to a commit. Security policy, Renovate, CodeQL and licence present; the contributing guide lives in docs/ rather than the root.

What the scanner counted

The raw findings

Every hit the scanner wrote out, with a link to the exact line at the scanned commit. Secrets candidates are redacted.

By the numbers

Lines by language: TypeScript 860.1K, JSON 188.4K, Rust 101.5K, Swift 42.4K, Markdown 17.1K, Kotlin 9,227.

Questions

Is AFFiNE free?

The desktop app and the self-hosted Community Edition are free. The client code is MIT; the server code has its own licence, with Community Edition parts under MPL-2.0 and an Enterprise Edition, adding features such as SSO and audit, sold by subscription. AFFiNE Cloud has a free tier and paid plans, and AFFiNE AI on the cloud is a paid add-on.

Does AFFiNE work offline?

Yes. It is local-first: workspaces are stored on your device and work without a connection. Sync and real-time collaboration happen when you connect a workspace to AFFiNE Cloud or to your own self-hosted server.

Can AFFiNE import from Notion?

AFFiNE can import Markdown and HTML, which is how Notion exports a workspace, along with other formats; the import options are in the app's import dialog. Complex Notion databases may need tidying after the move.

This post is part of GitHub Tools, where every repository is cloned and scanned before it is written up. The scan is a snapshot of one commit on one day; the repository has moved on since, so check it before you install.