Loading...
Loading...
Social Discovery Without Surveillance
Interest-based social discovery with real-time chat, voice/video, and AI moderation. No surveillance, no engagement-optimizing algorithms.
14
Live
0
Partial
0
Stub
0
Missing
28/30
Pages
40/45
APIs
100%
Security
Server-based community feeds with posts and threads
Interest-based user and community discovery
User-owned social connections, exportable
Ephemeral stories with 24h expiry
Community invite links with expiry and usage limits
WebSocket-based instant messaging in channels
Live voice and video calls in communities
Web push notifications for messages and mentions
AI-powered content moderation and toxicity detection
User and content moderation controls
WebAuthn passkey-based authentication
Custom AI agents in communities
End-to-end encrypted direct messages
Role-based permissions within communities
| Check | Status |
|---|---|
| CSRF Protection | Pass |
| Rate Limiting | Pass |
| Input Validation | Pass |
| Encryption | Pass |
| Security Headers | Pass |
| Auth / Session | Pass |
| Cache Headers | Pass |
Missing CSP header — XSS risk from user content
No HSTS header — downgrade attack possible
notifications INSERT policy WITH CHECK(true) — any authenticated user can create notifications for any user (spam/social engineering)
CSRF tokens missing on auth mutation routes
/api/og endpoint is open URL fetcher with no auth — SSRF risk against internal services
content_hashes INSERT allows user_id impersonation — no auth.uid() check in RLS policy
server_icons and server-banners storage UPDATE policies allow any authenticated user to overwrite any server assets
No rate limiting on WebSocket reconnections
/api/agents/ai-trigger accepts authorId from request body without verifying session match
45
Total Routes
40
Rate Limited
30
Total Pages
28
Live Pages