XARON · COMMUNITY PLATFORM
Your community. Actually yours.
A privacy-first home for gaming communities and creators — no ads, no data mining.
Visit site ›Live · xaron.co
E2E
encrypted DMs
1%
flat commission
0
ads, forever
End-to-end encrypted.
Direct messages no one else can read — not even us. Privacy is the default, not a setting.
Voice & video communities.
Free text, voice and video channels with screen sharing. No ads, no data mining, ever.
Creators keep it.
Paid subscription tiers and a real-time view of earnings — at a flat 1% platform commission.
UNDER THE HOOD
Encryption — OpenMLS, RFC 9420
Group messaging runs on OpenMLS, the Rust implementation of the IETF Messaging Layer Security standard — not a hand-rolled scheme. Members join and leave constantly in a gaming community, which is exactly the case MLS is built for: forward secrecy and post-compromise security that survive a churning roster.
Transport — WebTransport over QUIC
WebTransport is the only realtime transport — there is no WebSocket fallback, and production refuses to boot without a valid transport certificate. Because the API deliberately sends no cookies, sessions authenticate with a single-use ticket that lives thirty seconds, and clients pin the endpoint's leaf certificate hash.
A full Rust stack
Axum on the server, Leptos compiled to WebAssembly on the client — one language end to end, fifteen workspace crates split by concern. PostgreSQL holds the relational core, ScyllaDB the message firehose, Dragonfly the cache, Meilisearch the index, LiveKit the voice and video rooms.
xaron-authxaron-cryptoxaron-realtimexaron-mediaxaron-searchxaron-securityxaron-db+ 8 more
HOW THE BAR IS HELD
No panics in production
No unwrap() or expect() outside tests. Errors are values, all the way up.
Rate limit or no merge
Every new endpoint ships with a tiered rate limit. A missing one is a review blocker, not a follow-up ticket.
One gate, run on every PR
fmt, clippy with warnings denied, workspace tests, a WASM build, integration suites and a dependency audit — the same gate locally and in CI.
Playwright E2ELoad tests — REST + voicecargo audit in CIPrometheus + Grafana
RustAxumLeptos/WASMOpenMLS (RFC 9420)WebTransport/QUICScyllaDBLiveKit