Tracking issue for the adversarial Fathom-parity audit (98 agents; 81/87 findings confirmed against the code; 6 refuted).
Verdict
Not pound-for-pound with Fathom yet. Architecture is genuinely competitive (cookieless daily-salted hashing, single-table DynamoDB, uptime monitoring, full UTM/campaigns, link clicks, funnels, ingest-time bot/spam drop, OAuth+roles). Features are ~70–80% (several headline ones minted-but-inert). Correctness is the gap — confirmed critical data-accuracy and security bugs, and a privacy posture that undersells (live path doesn't honor DNT, no TTL on raw events, full IPs to US third parties).
Feature-parity scorecard
| Area | Status |
|---|---|
| Tracking — core (pageviews/SPA/events/UTM/clicks/bot-drop) | ✅ on par |
| Tracking — revenue/e-commerce | ❌ broken (#141, #132) |
| Tracking — GA import / migration | ❌ missing (#155) |
| Tracking — IP/path exclusion | 🟡 not enforced (#159) |
| Dashboard — breakdowns / realtime / funnels | ✅ on par |
| Dashboard — read API / shared / embeds | ❌ inert (#154, #152) |
| Dashboard — period comparison | ❌ broken (#153) |
| Dashboard — date range / segmentation / export | 🟡 partial (#139) |
| Privacy / compliance | 🟡 primitives solid, posture gaps (#140, #142, #143, #144) |
| Account / multi-tenant / billing | 🟡 real auth, billing inert (#156, #157) |
Recommended order (audit tiers)
Tier 0 — ship-blockers (security + silent data corruption)
- #160 — CRITICAL: XSS in served minimal tracker
- #161 — CRITICAL: lost session updates (concurrency)
- #162 — CRITICAL: late-event undercount across all stats
- #151 — SESSION# queries lack pagination (1MB truncation)
- #147 — unvalidated client sessionId
- #148 — visitor-hash collapse on unknown IP+UA
- #149 — heatmap points unbounded · #150 — scroll depths unbounded · #134 — event props unbounded
- #158 — no rate limiting on /collect, /t, key validation
- #130 — weak RNG (CSPRNG for keys/tokens)
Tier 1 — privacy posture
- #142 — honor DNT (+ GPC)
- #143 — TTL on raw events
- #144 — third-party geo IP / plaintext HTTP / ipAnonymization
- #140 — GDPR export/delete wrong index (erasure non-functional)
Tier 2 — parity-blocking features
- #141 — revenue end-to-end (+ #132 events/goals value)
- #152 — real shared dashboards
- #154 — read API
- #153 — period comparison
- #155 — GA4 importer
- #159 — enforce excludedIps/excludedPaths
Tier 3 — correctness polish & completeness
- #145 — bounce/entry race · #146 — unique double-count boundary
- #133 — CLS x1000 · #136 — timeseries UTC bucketing · #137 — comparison N+1 · #138 — sendBeacon/double-include
- #135 — server-side session timeout · #131 — multi-tenant leak when auth off · #157 — admin removes owner · #156 — billing
- #139 — reporting partials · #129 — low-severity backlog
Bottom line: Tier 0 + Tier 1 are the difference between "looks like Fathom" and "trustworthy like Fathom" — mostly small, surgical fixes. Tier 2 is what removes the asterisk on "switch from Fathom."