←~/progetti/outpaced/README.md

Outpaced

{ “date”: “2026-05-03”, “status”: “in development”, “stack_modules”: 7 }

Frictionless dependency monitoring for JavaScript and TypeScript projects

Outpaced is a public SaaS that gives immediate visibility into the state of npm dependencies: paste a package.json and within seconds get a complete dashboard of updates, CVE vulnerabilities, deprecated and abandoned packages. No repository access, no configuration, no automated pull requests.

The product's guiding principle is one: from sign-up to time-to-value in under two minutes. A centralized control point built for people managing multiple projects in parallel who need to know at a glance how many critical dependencies they have, which projects are most at risk, and what to update first.

## The problem

Today's dependency monitoring is dominated by two tool categories, both with clear limits for anyone who simply wants visibility:

·Pull-request bots (Dependabot, Renovate): require repo access, per-project YAML configuration and produce PRs, not an aggregate dashboard

·Enterprise security scanners (Snyk, Socket.dev, OWASP Dependency-Track): powerful but designed for teams with compliance, SBOM and reachability analysis requirements

The gap: nobody offers the "paste package.json → see the dashboard" flow. Outpaced positions itself as a complementary tool, focused on monitoring and visibility rather than automation.

## The solution

An intentionally linear user flow:

·Sign-up with email and password

·Create a Project, no wizard, direct landing

·Paste the package.json and optionally the lock file for precise CVE analysis

·Asynchronous analysis in the background

·Dashboard populated with each package's status: current version, latest available, update type, CVE, deprecations, abandonment

·Manual re-check up to 3 times per day plus automatic nightly check

·Email notifications when new critical alerts emerge

## Alert types

Four distinct signal categories:

·Outdated — update available, severity ranging from info (patch) to critical (major)

·Deprecated — package marked deprecated on npm

·Vulnerability — CVE from npm Audit and OSV with severity based on CVSS

·Abandoned — over 2 years without release combined with download decline; the dual criterion avoids false positives on mature, stable packages such as mime-types or ms

## Tech stack

Technical choices reflect product requirements:

·Frontend: SvelteKit, TypeScript and Tailwind CSS — SSR for public pages, SPA for the dashboard

·Backend: Go with stdlib and REST API — idiomatic concurrency with goroutines and channels, ideal for asynchronous workers and parallel jobs

·Database: PostgreSQL with structured relations and JSONB encrypted at rest for manifests

·Queue and cache: Redis + Asynq — separate queues for analysis and email, registry caching and daily rate limiting

·Auth: Better Auth — sessions, JWT, ready for future social login

·Transactional email via Resend or Postmark for deliverability and DX

·Data sources: npm Registry, npm Audit and OSV (Google) for metadata, CVE and future multi-ecosystem expansion

## Two-binary architecture

HTTP server and worker are two distinct binaries sharing the same Go domain package: same code, independent deploy and scaling, better operational resilience. A worker crash doesn't take down the API.

## Significant design decisions

Five choices that characterize the product:

·Client-side parsing for privacy by design: package.json and lock file are parsed in the browser; only the normalized structure reaches the server, never private registry URLs or embedded tokens

·Per-workspace encryption at rest: JSONB encrypted at column level with a distinct key per workspace; a DB dump exposes no readable data

·Rate limit as a product choice: 3 manual checks per day protect the infrastructure, respect public npm APIs and create the natural incentive to upgrade to V2

·Explicit API contract instead of shared types: OpenAPI as the source of truth between TypeScript and Go

·GDPR-first: account deletion equals immediate and irreversible removal, no retention period

## Roadmap

Three progressive value phases:

·V1 — MVP "manifest paste": auth, projects, package.json paste, asynchronous analysis, global alert center, rate limit with UI feedback, email notifications, nightly checks, status badge for README

·V2 — Git integration: OAuth GitHub, GitLab and Bitbucket, push webhooks, monorepo support, multi-user workspaces for collaboration

·V3 — Ecosystem expansion and monetization: requirements.txt, go.mod, Gemfile, in-product fix suggestions and PRs, paid tiers via Stripe, Slack notifications and custom webhooks

## What I'm learning

Operational lessons from rigorous product scoping:

·Saying no to "obvious" features (automatic PRs, repo integration in V1) to protect time-to-value

·Designing clear boundaries between server and worker from day one, sharing the domain without duplication

·Privacy as a design constraint rather than a checkbox: client-side parsing drove UX, API format and size-limit decisions

·Clear V1/V2/V3 roadmap to avoid building things nobody needs right now

Outpaced is a European product based in Italy, currently in development. Stay ahead of your dependencies.

// stack

[“sveltekit”, “go”, “postgres”, “redis”, “saas”, “devtools”, “dependency-monitoring”, ]