Online Community Planner
Research-backed planner built from a 60-product census of online community software across 120 official source pages — a community where members are strangers, moderators judge reports about people they know, and the directory is a list of everyone's contact details.
The problem this kills
A community looks like the easiest product in this catalogue. Spaces, posts, replies, a member list, some events. Ask a coding agent for one and it will build all of that in an afternoon, and it will look finished.
What it will not have decided is who may read what about whom. The members are strangers to each other. Moderators handle reports about people they know, and the person reported must not learn who reported them. The member directory is, underneath the avatars, a list of real people's contact details — and a community manager's export of that list is exactly as sensitive as the list itself. The naive build shows the directory to every member with the email addresses left in, guards the export, and never notices that the two paths serve the same rows.
What the research changes
The planner carries a frequency-ranked capability inventory from 60 real products — Circle, Mighty Networks, Discourse, Khoros, Salesforce Experience Cloud and 55 others — read across 120 official source pages, stratified from creator memberships to enterprise intranets, open-source forums and civic consultation platforms.
The inventory shows where public marketing goes quiet. Spaces and groups are documented by 50 of 60 products and data export by 48. But the reporting and moderation queue appears on only 9 of 60 pages, privacy and visibility controls on 4, and moderation audit history and escalation on 1. Roles and scoped access reach just 20. The capabilities a buyer's members will actually depend on are the ones the market barely describes, so the planner raises them on lifecycle dependency instead of frequency.
What it makes the agent decide
- Which fields of a member one member may read about another, and whether an email address is ever one of them.
- Whether an export re-derives its rows from the same scoped query as the screen it exports, or becomes a second, unguarded copy of the directory.
- Whether a reported member can ever learn who reported them — through the queue, a notification or a history screen.
- What a member who hides themselves from the directory hides from: other members only, or staff as well.
- Whether a denial says not-found or forbidden, so a member cannot confirm a private space exists by reading a status code.
The frequency-ranked ledger.
Real apps this planner built.
LiveA directory that never hands out an address
“Hearthside” — the highest-scoring build of the three, and the one that treats the member directory as what it is: a list of real people who are strangers to each other. The directory never selects an email address at all, and the same visibility rule guards the list, a profile opened by its id, a member's connections and search, so there is no second door into what the first one withholds. A member who hides from the directory answers not-found rather than forbidden. The member list and its export are refused to ordinary members and hosts alike. You land on the community's public page; choose Sign in and pick a role — community manager, moderator, member or host. Those buttons are switched on deliberately here, run through the same session service as a password sign-in, and in production the build keeps them off even if the setting is left on.
Open live demo →
LiveThe most defended build in the programme
“Gatherwell” — the only build of the three that throttles sign-in attempts, and one that refuses any change that does not come from its own origin. Retried requests are replayed rather than applied twice, concurrent edits are caught instead of overwriting each other, and every audit entry is written in the same transaction as the change it records. The member list and its export are literally the same request, so they cannot drift apart. It arrived with two operational faults — deleting its database stopped it from starting, and its own test suite could not be re-run against what it delivered — and both were repaired and re-verified, so it was rescored 92 → 97; this is the repaired build. You land on a sample community's public page; choose Sign in and pick a role. The role buttons are the build's own, switched on for this sample environment.
Open live demo →