Identity
LiveLowercase handles, Argon2id password hashing, normalized emails, and strict validation at every boundary.
Splots is a communication platform built end to end in Rust — direct messages, communities with roles and channels, and live presence on hardened sessions. Fast by default, boring by design.
Text channels
You
Online
This is the start of the #general channel. Say hi.
Ada11:42
finally, a chat with actual channels and no nonsense.
Nori11:44
wait, DMs and communities are live already?
Kai11:45
yep — and channels, roles, and invites too.
Online — 4
What's inside
Everything that ships is real and wired end to end — no mock data, no feature flags pretending to be features.
Lowercase handles, Argon2id password hashing, normalized emails, and strict validation at every boundary.
Opaque 256-bit tokens stored only as SHA-256 digests, HttpOnly cookies, CSRF-signed forms, and per-session revocation.
Display names, bios, status lines, accent colors, and content-validated avatar uploads with atomic writes.
Security
No bolt-on auth vendor, no session data in local storage. Every credential, token, and permission check runs inside the same Rust server that renders the page.
Start with a safe accountArgon2id by default
Passwords are salted and hashed with tuned memory cost — never stored or logged in plain text.
Opaque sessions
Only SHA-256 digests reach the database. Cookies are HttpOnly, Secure, and SameSite=Lax.
Signed forms
Every state-changing request carries a session-bound CSRF token and a same-origin check.
Bounded input
Per-action rate limits, strict field validation, and uploads that are inspected before they touch disk.
Roadmap
No fake chat, no placeholder data. Only surfaces that actually work are enabled.
Foundation
ShippedAccounts, sessions, profiles, design system, and the server-rendered shell.
Messaging
ShippedDirect messages, groups, history, edits, reactions, attachments, and reconnect recovery.
Communities
ShippedServers, channels, categories, invites, roles, and moderation.
Realtime hardening
ShippedPresence, typing indicators, bounded queues, and backpressure under load.
Operations
ShippedObservability, rate-limit tuning, and production deployment profiles.