Building an offline-first API governance platform
YASP is a full-stack platform for managing, exploring, and validating OpenAPI specifications — with an interactive spec editor, a live testing interface, and AI-powered spec generation, all without routing document data through a cloud service. Built for developers who want a fast, private alternative to SaaS API tools.
The problem
Developers need a fast, offline-capable way to manage, explore, and validate OpenAPI specifications without routing document data through a cloud service. Most API-documentation SaaS tools require an account and send every spec you open to a third-party server — a non-starter for teams working with internal or unreleased APIs.
What I built
A full-stack API governance platform with an interactive spec editor built on CodeMirror 6, a live "Try It Out" testing interface that proxies requests server-side to avoid CORS issues, AI-powered spec generation via OpenRouter, and Spectral linting running inside a Web Worker for non-blocking quality scoring. All spec data is stored in IndexedDB — no backend required for core functionality. It also ships as a desktop app via Tauri, sharing the same core package as the web build.
Engineering decisions
Why isolate linting in a Web Worker instead of running it on the main thread?
Spectral linting on a large OpenAPI spec is CPU-heavy enough to visibly stutter typing in the editor if it runs on the main thread. Moving it to a Web Worker keeps the editor responsive regardless of spec size, at the cost of a slightly more complex message-passing setup between the worker and the UI.
Why store everything in IndexedDB instead of requiring a backend account?
Most competing API tools require a hosted account and sync specs to their servers by default. For teams working with internal or pre-release APIs, that's a real objection. IndexedDB-first storage means the core tool works fully offline with zero account friction — a backend becomes optional, not required.
Why proxy "Try It Out" requests server-side instead of calling APIs directly from the browser?
Testing a third-party or internal API directly from the browser routinely hits CORS restrictions the API owner never configured for this use case. A server-side proxy sidesteps that entirely, with URL allowlisting and private-network blocking added specifically to prevent the proxy itself from becoming an SSRF vector.
Why also ship a Tauri desktop app instead of just the web version?
Some users want a local-only tool that never touches a browser tab, especially for sensitive internal specs. Tauri let the desktop build share the same core package as the web app — one codebase, two distribution targets, rather than maintaining a separate desktop implementation.
Operational details
SSRF prevention
The API-testing proxy enforces URL allowlisting and blocks requests to private-network ranges, preventing the proxy from being used to reach internal infrastructure.
Offline-first storage
Specifications persist in IndexedDB with no account requirement — the editor and linter work with zero network dependency after first load.
AI-assisted authoring
OpenRouter powers both spec generation from a description and one-click fix suggestions surfaced directly from Spectral lint results.
Shared core, two targets
The Tauri desktop build and the web build share the same core package, so features and fixes ship to both without duplicated implementation.