Why We Audit Every SaaS Dependency for Platform Risk — The 5-Question Framework That Caught 3 Pivots Before They Hurt Us

TL;DR: “Investing months in Fable only for it to change/disappear” — Khanjun’s thread. We now audit every new tool with 5 questions before it touches production. Caught Copilot token pricing, Linear API deprecation, Notion export gaps pre-adoption. Platform risk audit template →

The Context

Two-dev team, Basso Digital. June 2026: Watched platform dependency risk discussion explode on X. Pattern: team adopts tool → builds workflows → vendor pivots (pricing/API/shutdown) → team stuck. Our close calls: Almost standardized on Fable (shut down), considered Linear deeply (API v1 deprecation), evaluated Notion for wiki (export fidelity issues).

What We Tested

Tool	Risk Flagged	Audit Question That Caught It	Action
Fable	Shutdown risk	Q4: “Company runway < 18 months?”	Passed; chose Plane self-hosted
Copilot	Pricing pivot	Q1: “Usage-based billing with no caps?”	Hybrid stack; budget alerts
Linear	API deprecation	Q3: “API v1 sunset < 12 months?”	Kept but pinned v1; migration plan ready
Notion	Export fidelity	Q2: “Full data export in open format?”	Chose Obsidian + Quartz
Vercel	Vendor lock-in	Q5: “Exit cost > 2 weeks engineering?”	Moved to Coolify

The Pivot Point

June 8, 2026: Fable shutdown announcement. 3 teams in our network lost 6+ months of workflow investment. Same day: Copilot token pricing leaked. Realization: We had no systematic way to say “no” to shiny tools. Built the audit to make risk visible before commitment.

What We Use Now

5-Question Platform Risk Audit (required for any new production dependency):

## Platform Risk Audit: [Tool Name]

### Q1: Pricing Model Durability
- Is pricing flat-rate or usage-based?
- If usage-based: hard caps? grandfathering? advance notice period?
- **Red flag**: Token/credit model with no ceiling, no grandfathering, < 90 days notice

### Q2: Data Portability & Exit
- Full export in open standard (SQL, JSON, Markdown, OpenAPI)?
- Export includes: config, history, relationships, secrets?
- **Red flag**: Proprietary export, rate-limited API, "contact sales" for bulk

### Q3: API & Contract Stability
- Public API versioning policy? (SemVer? sunset timeline?)
- Breaking change notice period? (Industry standard: 12+ months)
- **Red flag**: No public API, v1 deprecated < 12 months, "moving fast" culture

### Q4: Company & Community Health
- Runway > 24 months? Profitable or funded by aligned investors?
- Community: active Discord/GitHub? Third-party integrations?
- **Red flag**: Single-founder, no revenue, Discord dead, no third-party ecosystem

### Q5: Exit Cost Estimation
- Engineering weeks to migrate off? (Include: data, workflows, integrations, team retraining)
- **Red flag**: > 2 weeks for core workflow; no migration tooling exists

### VERDICT: [ADOPT / ADOPT WITH MITIGATION / DEFER / REJECT]
Mitigation plan (if adopted with risk): _______________

Recent Audits (last 30 days):

Tool	Verdict	Mitigation
Inngest	Adopt w/ mitigation	Self-hostable; export JSON; pin version
Clerk	Adopt w/ mitigation	User data portable via API; auth migration doc prep
Resend	Adopt	Flat pricing; standard SMTP fallback; open SDK
Cursor	Defer (for core)	Proprietary editor; no Routine export; keep for Composer only

When You’d Choose Differently

• Prototype/throwaway code: Skip audit; velocity > durability
• Industry-standard infra (AWS, Stripe, GitHub): Audit still runs but verdict almost always “Adopt” — exit cost is industry problem
• Team with dedicated platform engineers: Can absorb higher exit costs; audit thresholds adjust

Tool Crucible Rating

Dimension	Rating (1–5)	Notes
Overall	5	Audit prevents lock-in; 15 min investment saves months
Ease of Use	5	5 questions, markdown template, PR gate
Value	5	Caught 3 pivots in 30 days; ROI incalculable
Support	4	Template in repo; team knows the drill

---

This is part of our Platform Dependency Risk series. See template: Platform Risk Audit Template