rybbit - Moses Yebei

The Problem

Web analytics is dominated by Google Analytics, which is privacy-hostile, cookie-dependent, and notoriously complex. Teams that want privacy-friendly, self-hosted analytics often sacrifice depth — Plausible is simple but shallow, and GA4 is powerful but opaque. Rybbit targets the gap: cookieless analytics with session replays, funnels, journeys, and advanced filtering, deployable on your own infrastructure.

What This Does

Rybbit is a full-stack web analytics platform. The client/ directory (696 files) is a Next.js/React application with Tailwind, handling dashboards, funnels, goals, and session replay. The server/ directory (248 files) is an Express/TypeScript API backed by PostgreSQL and ClickHouse. A monitor-agent/ (27 files) handles uptime checks, and shared/ (9 files) holds cross-project types.

The repository is actually a portfolio of four self-contained projects sharing a domain, not a single monolithic codebase. Each has its own package.json and Dockerfile. The README positions it against GA4, Plausible, and Cloudflare, with features like 3-level location tracking and user profiles.

How It Is Wired

Execution starts at monitor-agent/src/index.ts:5 in the start function, which reaches only 2 functions — the agent is a small, isolated component. The main application flow is not mapped from an entry point in this analysis; the framework callbacks (Next.js routes, Express handlers) are invisible to static import graphs.

Everything routes through a handful of hubs. server/src/db/postgres/postgres.ts has 90 modules importing it (instability 0.01 — highly stable, rarely changes), and client/src/api/analytics/endpoints/index.ts has 88 importers but imports 13 modules itself (instability 0.13). The client/src/lib/store (80 importers) and client/src/api/utils.ts (64 importers) are the client-side chokepoints.

The most-called internal functions are cn (97 call sites), authedFetch (37), and buildApiParams (21). The client's authedFetch is the single gateway for all authenticated API calls — changing its signature breaks 37 call sites. Server-side, server/src/db/postgres/postgres.ts and schema.ts (86 importers) are where schema changes ripple widest.

Four modules participate in circular import dependencies, including server/src/services/tracker/utils.ts and client/src/app/[site]/globe/globeStore.ts. These cycles mean a change to one module can trigger subtle initialization-order bugs in the other.

How To Use It

The README documents two paths: hosted service or self-hosting. For self-hosting, the repo includes clickhouse/docker-compose.clickhouse.yml and a Caddyfile for reverse proxying.

git clone https://github.com/moses-y/rybbit
cd rybbit
# Server: npm install && npm run dev (in server/)
# Client: npm install && npm run dev (in client/)
# ClickHouse: docker compose -f clickhouse/docker-compose.clickhouse.yml up -d

Configuration lives in .env.example at the root — copy it to .env and set database credentials, ClickHouse connection, and any auth keys. The exact server start command is not documented in the README excerpt; check server/package.json scripts.

Real-World Use

A typical deployment: a SaaS company embeds the tracker script on its marketing site and app. The client sends events to the server, which writes raw data to ClickHouse for fast aggregation and metadata to PostgreSQL. The team monitors funnels (signup → activation → retention) in the React dashboard, uses session replays for debugging UX issues, and sets up the monitor agent to check uptime across regions. The monitor-agent checks regions via db.query.agentRegions.findMany — the only traced external effect.

Code Health & Issues

Static analysis (not opinion) found 167 findings: 43 high, 123 medium, 1 low. Key items:

Critical - OAuth token in workflow - .github/workflows/claude.yml exposes CLAUDE_CODE_OAUTH_TOKEN to contributor-controlled PRs; move to workflow_run or environment-gated jobs.
High - Unpinned GitHub Actions - .github/workflows uses @v1/@v3 tags; pin to commit SHAs.
High - Direct push to master - .github/workflows/translate-docs.yml runs git push origin master with no test gate.
High - Duplicated code blocks - 1,815 repeated 6-line blocks across 348 files; DRY the API endpoints.
High - Deep nesting (14 files) - docs/.../ComparisonPage.tsx hits indentation depth 7.
Medium - 60.5MB GeoLite2-City.mmdb in git; move to LFS or object storage.
Medium - 6 test files against 806 source files (ratio 0.007); coverage is nominal.
Medium - No dependency vulnerability scan in CI.

The Bottom Line

Rybbit is a serious, feature-rich analytics platform with strong architecture in the client and a clean separation between ClickHouse and PostgreSQL concerns. The critical CI secret exposure and the test gap are real blockers for production adoption — fix those before trusting it with traffic data. For a team wanting GA4-level depth with self-hosting, this is worth evaluating; for a team wanting a drop-in simple tracker, Plausible remains lighter.

What the analyser found

Deployment readiness

7/7

Container image
CI pipeline
Lockfile committed
Test suite
README
License
No committed secrets

Composition

1,581 files

TSX577
TypeScript469
JSON59
Markdown18
YAML13
JavaScript6

ReactNext.jsExpressTailwindDocker

Module dependencies

The 10 most depended-upon modules of 1,058, from static import analysis. Red outline marks a module in an import cycle.

graph LR n0_ver_src_db_postgres_postgres["postgres"] n1_pi_analytics_endpoints_index["index"] n2_erver_src_db_postgres_schema["schema"] n3_client_src_lib_store["store"] n4_client_src_api_utils["utils"] n5_ent_src_components_ui_button["button"] n6_src_db_clickhouse_clickhouse["clickhouse"] n7_client_src_lib_utils["utils"] n8_rc_api_analytics_utils_utils["utils"] n9_server_src_lib_auth_utils["auth-utils"] n4_client_src_api_utils --> n3_client_src_lib_store n8_rc_api_analytics_utils_utils --> n0_ver_src_db_postgres_postgres n8_rc_api_analytics_utils_utils --> n2_erver_src_db_postgres_schema n0_ver_src_db_postgres_postgres --> n2_erver_src_db_postgres_schema n9_server_src_lib_auth_utils --> n0_ver_src_db_postgres_postgres n9_server_src_lib_auth_utils --> n2_erver_src_db_postgres_schema

What would stop me shipping this

Ranked by severity × confidence × production reach. Reach is the honest discriminator across a collection that is mostly other people's code: the same finding matters more in something that ships.

critical1

high2

medium5

low1

Keep secrets out of workflows a fork can triggercritical

.github/workflows/claude.yml

CLAUDE_CODE_OAUTH_TOKEN (publish or cloud scope)

Contributor-controlled input reaches a job holding a publish token or cloud credential, so a pull request becomes credential exfiltration.

Fix: Move secret-using steps into a workflow_run job that never checks out pull request code, or gate on an environment with required reviewers.

Pin third-party GitHub Actions to a commit SHAhigh5 occurrences

.github/workflows

anthropics/claude-code-action@v1, docker/setup-buildx-action@v3, docker/login-action@v3, docker/metadata-action@v5

A tag can be moved, so the action running with your token and secrets is whatever its owner last pushed; this is how tj-actions/changed-files leaked secrets from thousands of repos.

Fix: Replace each @vN with the 40-character commit SHA, keep # vN as a comment, and let Dependabot bump the SHAs.

Open a pull request instead of pushing to the default branchhigh

.github/workflows/translate-docs.yml

git push origin master

Automated commits land on the branch that deploys, with no test having run against the result.

Fix: Push to a bot branch and open a pull request, or restrict the push to a tag ref.

Pin the container base image by digestmedium

client/Dockerfile

node:20-alpine

An untagged or mutable base means today's build and last month's contain different libc and a different CVE set, with no record of which shipped.

Fix: Use image:tag@sha256:<digest> and enable Dependabot's docker ecosystem.

Gate pull requests on a dependency vulnerability scanmedium

.github/workflows

no dependency scan in CI

This is the one gate that would catch a known-vulnerable package before it reaches a build, and no repository in the sample had it.

Fix: Add dependency-review-action on pull_request, or osv-scanner on push and a schedule.

Move large binaries to Git LFS or out of the repositorymedium3 occurrences

server/GeoLite2-City.mmdb

3 blobs over 5MB: GeoLite2-City.mmdb 60.5MB, subdivisions.json 14.4MB, countries.json 10.1MB

One repository here carries twenty blobs over 5MB including a 10.9MB spreadsheet, so every clone and every CI checkout pays for data nobody diffs.

Fix: Track those extensions with LFS, or move datasets to object storage and fetch them in a setup step.

Set persist-credentials: false on checkoutmedium

.github/workflows/translate-docs.yml

checkout keeps the token, then dependencies are installed

The token stays in .git/config for every later step, so a malicious postinstall script reads a pushable credential without one ever being passed to it.

Fix: Add with: persist-credentials: false, and pass an explicit token only to the step that pushes.

Expand the test suite; it cannot cover this codebasemedium6 occurrences

6 test files against 806 source files (ratio 0.007)

A reviewer reads "has tests" and assumes a safety net that covers two files out of eighty-five, which is how untested paths ship behind a green badge.

Fix: Add tests for the highest fan-in modules first.

Set timeout-minutes on the workflow jobslow4 occurrences

.github/workflows/claude.yml

4 workflow(s) declare no job timeout

A wedged step runs to the six-hour platform default, which on a two-hourly schedule means three runs overlap behind it.

Fix: Add timeout-minutes with a realistic bound to each job.

Checked deterministically against the repository tree and a bounded set of its files: committed credentials, unpinned actions and base images, missing lockfiles and update bots, workflows that discard failures, published advisories against the declared dependencies, runtime configuration, licensing and notebook reproducibility. No language model is involved in this section.