Overview · Coverage · Risks

The whole stack — web, worker, Postgres, Redis — rides one VPS. A host outage, disk failure, or noisy-neighbour stall takes the entire product down with no automatic failover.

Mitigation: Nightly off-host backups with restore drills, a documented one-command rebuild, and a costed warm-standby plan to lift before the first paid event.

India's DPDP Act constrains where personal data may live and how it is processed. A VPS or backup region outside the permitted boundary, or an unreviewed sub-processor, is a regulatory exposure.

Mitigation: Pin compute and backups to an approved region, maintain a sub-processor register, and gate any new vendor behind a residency review before integration.

Core flows are exercised by automated tests, but the live event-day path (compressed clocks, realtime fan-out, web push) has thin end-to-end coverage against real infrastructure, so regressions can reach a live event.

Mitigation: A scheduled live-verification run against a production-shaped environment, with a go/no-go gate before each event window and alerting on the verification job itself.

Running our own outbound mail means a cold IP and domain reputation. Without a staged warmup, transactional mail (verification, invites, receipts) lands in spam or is throttled by major providers.

Mitigation: Staged volume warmup with SPF/DKIM/DMARC aligned, seed-list monitoring, and an ESP fallback ready to switch the transactional stream if reputation degrades.

iOS only delivers web push to home-screen-installed PWAs and silently drops permission edge cases. Users who never add to home screen get no live event alerts, undermining the realtime promise.

Mitigation: Detect install state, prompt add-to-home-screen at the right moment, and fall back to email/SMS for critical event alerts when web push is unavailable.