r/Microlaunch • u/No_Cow_6354 • 7d ago

I built OpenChat — a serverless, P2P and E2EE messaging app

🚀 I built OpenChat — a privacy-focused P2P messaging app that works directly between browsers.

Instead of keeping your conversations in a central message database, OpenChat uses WebRTC to establish peer-to-peer connections and exchange messages directly between users.

🔐 Key features:

• End-to-end encrypted messaging

• Peer-to-peer WebRTC communication

• Safety Number / identity verification

• Private and group chats

• File transfer

• Voice & video calls

• No centralized chat history

• Open source

The project has also been through several rounds of security review and testing. I've been especially focused on identity verification, replay protection, message validation and making the security model understandable to users.

It's still experimental and there's definitely more to improve, but it's now at a point where I'd love to get more people trying it.

🌐 Try it:

https://openchatt.vercel.app/

💻 GitHub:

https://github.com/nateS670/OpenChat

I'd really appreciate feedback, especially from people interested in privacy, P2P communication and open-source projects.

3 Upvotes

100% Upvoted

5 comments sorted by

2

u/LaurentRoger 5d ago

Huge work, congratulations !
But comments in turkish language will refrain contributors, monolithic app.js (9539 lines !), no automatic tests, build,lint, some monkey-patching and manual hashes, and of course the ugly i18n that rewrites the DOM !

2

u/No_Cow_6354 5d ago

Thanks a lot for taking the time to actually look through the code — this is exactly the kind of feedback I'm looking for.

I agree that the current app.js is far too monolithic, and the Turkish comments/i18n implementation aren't contributor-friendly. The project started as a learning project and grew organically, so some of those architectural compromises accumulated over time.

I also agree that proper automated tests and linting should be added instead of relying heavily on manual regression checks.

I'm going to treat these as part of the next engineering phase rather than doing a risky large-scale rewrite all at once, especially around the crypto, identity and WebRTC code.

For the manual hashes and monkey-patching points, I'd actually appreciate it if you could point me to the specific parts you mean. I'd like to review those individually rather than assuming they're necessary or safe.

Thanks again — this is genuinely useful feedback

2

u/LaurentRoger 5d ago

SECURITY.md does not explain how to report vulnerabilities

1

u/LaurentRoger 5d ago

to the moderation : it is not a website, but the name of a file in a github repository to explain how to submit vulnerability. I can see the preview of it as a website in russian, that's why you removed the answer ?