Platform risk
Building your product on a vendor runtime, hosted backend, or plugin stack that can EOL, price-shock, or pivot — leaving you with a migration as the roadmap.
Platform risk is what happens when convenience is mistaken for ownership. Parse, Heroku free tiers, Flash, Silverlight, and a thousand BaaS and plugin stacks made shipping feel cheap until the vendor changed the deal. Suddenly your "infrastructure" was a product decision with a kill switch, and migration became the only sprint that mattered.
The pattern thrives because leased land looks like free land on a demo day. Auth, push, rich UI runtimes, and one-click deploys hide the exit cost. When Apple kills a plugin, Microsoft ends a runtime, or a cloud product sunsets a free tier, the invoice is not the subscription — it is the rewrite under a hard calendar.
Not every hosted service is a trap. The failure mode is building core UX and data models that cannot move without a full client rewrite. Open protocols, exportable data, and thin adapters are boring insurance. Vendor lock-in sold as "focus on your product" is fine until the keynote announces your platform is legacy.
Ask the eviction question early: if this vendor disappears in eighteen months, is the migration a weekend or a company-threatening freeze? If you cannot answer, you do not have a platform strategy — you have a dependency with better marketing.
Exhibits
Platform · 2011–2017
Parse
BaaS before Firebase owned the category. Open-sourced on the way out; trust never recovered.
$ Facebook shut down Parse with a year's notice, forcing thousands of mobile backends into emergency migrations or self-hosted forks.
Platform · 2007–2023
Heroku
git push deploy and twelve-factor bliss. The PaaS that taught a generation what deploy should feel like — then priced them out.
$ Free-tier sunsetting and Salesforce neglect sent hobbyists and startups shopping mid-project. Dyno pricing that made sense at demo scale became a line item at traction.
Platform · 2014–now
Firebase
Auth, realtime DB, and hosting as a product. Prototype paradise; vendor lock purgatory at scale.
Framework · 2007–2013
Silverlight
.NET in the browser via plugin. Netflix used it; the web moved on anyway.
$ Enterprises built internal dashboards and streaming pilots on Silverlight just as HTML5 and iOS said no to plugins. Migration projects burned budgets Flash already warned them about.
Platform · 1996–2020
Adobe Flash
Animations, games, and video in a plugin the web learned to hate. Steve Jobs wrote the obituary; HTML5 dug the grave.
Framework · 2009–2019
Apache Cordova / PhoneGap
HTML in a native WebView with camera plugins. The first cross-platform mobile bet before React Native ate lunch.
$ Teams shipped WebView shells as "native apps," then paid twice for performance fixes, plugin rot, and App Store rejections when users noticed the jank.
Practice · 2018–2025
Low-code will replace eng
Drag-and-drop apps for the enterprise backlog. Useful for internal tools; fantasy as a full replacement for engineering — a pitch later absorbed by AI demos.
Practice · 1995–now
Heavy SAP customization
Customize the ERP until upgrades are impossible. The enterprise tax that keeps consultants in villas.
$ ABAP extensions and bespoke modules that made every upgrade a multi-year program. Millions spent aligning ERP to process instead of process to ERP.
Framework · 2013–now
Ionic
Mobile UI kit on Cordova then Capacitor. Still ships hybrid apps for teams that prioritize one codebase over polish.
Framework · 2013–now
Electron
Chromium in a trench coat. Slack, VS Code, and RAM usage everywhere you look.
Practice · 2023–now
Shadow AI / paste-into-ChatGPT
Prod data into consumer chat because the approved tool is slow. GDPR with better autocomplete.
$ Employees routed tickets, logs, and customer PII through consumer chat before InfoSec finished procurement. Compliance scramble followed the demos.
Practice · 2023–now
Prompt injection as afterthought
Ship the chatbot, bolt on security later — OWASP's new category, same old afterthought.
$ Customer-facing chatbots shipped with tool access and "security in phase two." Indirect injection via docs and tickets became the new XSS.