Security teams drown in alerts that all demand the same twelve manual steps. Shuffle is an open-source security orchestration, automation, and response platform that turns those steps into visual workflows: an alert arrives from the SIEM, Shuffle enriches it against threat intelligence, opens the ticket, isolates the host, and messages the analyst, without anyone copying values between browser tabs. Analysts assemble workflows on a canvas from more than two thousand pre-built app integrations covering email, EDR, firewalls, ticketing, chat, and cloud services, and any tool with an OpenAPI description can be converted into a new app automatically, exported again, and reused outside Shuffle. Webhooks, schedules, and pipeline triggers start executions; custom Python covers the odd cases; conditional branches and sub-workflows keep one big playbook from becoming spaghetti. Multi-tenancy with sub-organisations, roles, single sign-on, and MFA fits managed security providers running one deployment for many customers, and execution workers can run on premises closer to the systems they touch. Community members publish workflows and apps to a marketplace, so a phishing triage playbook that works for one SOC can be running in another by lunchtime. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.