u/Appropriate_Flow9789

Recently inherited a codebase and did a proper dependency audit.

At first glance, things looked fine. Around 70 to 80 direct dependencies, mostly maintained.

Then I checked the full tree.

It blew up to 1000 plus transitive packages. Many untouched for years. Some effectively abandoned, a few with known vulnerabilities and no fixes.

To make it more interesting, we have a compliance review in a few weeks and need to produce an SBOM.

The problem is the tooling. Everything gets flagged at similar severity with no context about what is actually reachable in the app vs what just exists somewhere deep in the tree. So instead of clarity, I get a huge list of issues I cannot realistically fix in time.

This isn’t a clean greenfield setup either. It’s something that evolved over years.

Trying to figure out:

How do you approach this under time pressure?
Do you only focus on reachable vulnerabilities?
How do you present an SBOM without it looking like everything is on fire?

Would really appreciate how others have handled similar situations.

Six months ago I had no idea what I was doing. No coding experience, no real plan, just an idea I couldn’t drop.

Everyone around me thought it was a phase. I built it anyway. Long days, constant doubt, a lot of almost quitting.

The product helps people practice real conversations out loud. Interviews, dates, tough talks.

Building was hard, but getting users was worse. I tried everything. Nothing worked. Zero revenue.

At some point I stopped juggling tools and simplified. I used Runable to create pages and demo assets faster. Still had to rewrite everything, but at least I was shipping.

Still, no traction.

Then last night, 11 pm, I got a notification.

Someone I don’t know paid for the yearly plan.

I just sat there staring at my phone.

It’s not about the money. It’s that someone saw it, tried it, and decided it was worth paying for.

After months of doubt, that one moment made it feel real.

If you’re in that phase where nothing is working, keep going. That first signal hits different.