plausible/analyticsapp

Audited from a 0k-token evidence dossier; 4 files read, 13 probes answered.

Plausible is a self-hostable, privacy-first analytics platform positioned as the GDPR-friendly alternative to Google Analytics, backed by a paying cloud subscriber base ^[27].

The central tension is between well-tested application code and a static/security posture — high-severity CVEs, dozens of secrets findings, no visible main-app lockfile — that a team self-hosting visitor data would need to weigh before deployment ^[4], ^[29].

The main knocks:

• The static scan surfaces findings the README never engages with. The dependency scan reports 17 high-severity CVEs and no lockfile is present for the main application, while a secrets sweep of the working tree and recent commits turns up 69 unique findings ^[4], ^[29], ^[18]. None of this is addressed in the README's security claims, which is exactly the gap hype_substance is built to catch.
• Most open issues are simply abandoned. 63% of open issues are stale beyond 180 days, and the response-time sample size was too small to even compute a median ^[3]. For a product people run against production traffic, that's a weak signal on whether reported problems get looked at.
• The self-hosting path — the thing that makes this an 'app' rather than pure SaaS — can't be verified from what's here. The README section addressing self-hosting is cut off mid-answer, and the manifest evidence shows no lockfile for the core Elixir/JS app ^[27], ^[29]. An adopter evaluating the community edition has to go outside this dossier to confirm the install path actually works end-to-end.
• Contribution is concentrated in a small circle despite the large contributor count. Top-10 contributors hold 92% of the activity share even though the project reports 100+ contributors ^[3], which is a bus-factor flag worth knowing going in.

What holds up:

• The core UI logic is genuinely well tested, not just claimed to be. 328 test files carry real assertions, and the single most graph-central dashboard file is exercised by 15 separate test files ^[16], ^[17]. That's evidence of actual test discipline rather than a coverage number for show.
• Release and funding cadence point to a project that will still be here in three years. 44 releases total with 19 in the last 24 months and a commit on the audit date itself show sustained, funded development rather than a project coasting on stars ^[3], ^[27].
• The application code reads as carefully engineered, not bolted together. The combobox component and interval-selection logic both show deliberate handling of edge cases (custom date ranges, keyboard nav, disabled states) rather than the ad hoc patching typical of fast-growing dashboards ^[8], ^[9].
• Contribution process itself is healthy even if the contributor base is concentrated. External authors land 74% of merged PRs and 95% of sampled merges carried at least one review, with a clear AGPL-3.0 license and full community-health file set in place ^[3], ^[13].

A capable, actively funded analytics app with disciplined testing, undercut by unaddressed high-severity CVEs, a large secrets footprint, and a stale issue backlog.

Umami and Fathom serve similar privacy-first analytics niches; comparison not evidenced in this dossier.