A safety-first social feed and livestreaming platform built on transparent, community-governed ranking.
Candor is a social feed and livestreaming platform that puts safety and transparency first. Unlike traditional platforms that hide their ranking logic and auto-suppress content without review, Candor:
- Publishes its feed ranking algorithm — every weight, every factor, community-governed
- Routes flagged content through AI review instead of auto-suppression
- Collects zero personally identifiable information — identity is cryptographic (Ed25519), not demographic
- Runs a real-time safety pipeline for CSAM detection, TVEC screening, and child protection on every piece of content before it enters the feed
- Supports livestreaming with sub-10-second TVEC kill switch and real-time transcription
This repository contains the open-source feed service — the core engine that powers content ingestion, ranking, caching, and delivery. The safety microservices that protect the platform are maintained separately as closed-source components.
┌─────────────────────────────────────┐
│ CLOUDFLARE EDGE │
│ DDoS · WAF · CF-Ray Enforcement │
└──────────────┬──────────────────────┘
│
┌──────────────▼──────────────────────┐
│ CANDOR FEED │
│ Node.js 20 · PostgreSQL 16 │
│ Redis · port 3001 │
│ │
│ ┌─────────────────────────────┐ │
│ │ safety-client.js │ │
│ │ HTTP bridge → safety layer │ │
│ └──────────┬──────────────────┘ │
└─────────────┼───────────────────────┘
│
┌───────────────────────┼───────────────────────┐
│ │ │
┌──────────▼──────────┐ ┌─────────▼──────────┐ ┌─────────▼──────────┐
│ THREATSHIELD │ │ GUARDIAN SHIELD │ │ PHOTODNA CSAM │
│ TVEC · Extremism │ │ Child Protection │ │ Hash Screening │
│ Dual-model AI │ │ 8-Layer Detection │ │ Fail-closed │
│ [Private Service] │ │ [Private Service] │ │ [Private Service] │
└──────────────────────┘ └────────────────────┘ └────────────────────┘
Infrastructure: Fly.io (primary, US) · 1984 Hosting Iceland (warm standby, candornetwork.is) · Cloudflare (edge) · Netlify (frontend) · Upstash Redis · Cloudflare R2
Every post is scored transparently. Weights are public and community-governed.
OFA_Score =
( genuine_engagement × 0.40 )
+ ( source_credibility × 0.60 )
− ( suppression_flags × ts_review_weight )
− ( ad_content_penalty × 30 )
+ ( community_verify_bonus × +5 )
// Suppression flags route to AI review BEFORE any score penalty is applied.
// All weights are public. Changes require a community governance vote.
Key principles:
- No auto-suppression — flagged content goes to Truth Shield review, not the bin
- Ads are demoted, not boosted
- Accountability journalism gets credibility weight, not shadow-banning
- Every ranking decision is auditable
Candor runs a multi-layer safety pipeline on all content before it enters the feed. This repository's lib/safety-client.js is the HTTP bridge to those services.
| Layer | Service | Status |
|---|---|---|
| CSAM image screening | Microsoft PhotoDNA | ✅ Production |
| CSAM reporting | NCMEC CyberTipline ESP | ✅ Approved May 30, 2026 |
| TVEC / extremism detection | ThreatShield (dual-model AI) | ✅ Production |
| Child account protection | Guardian Shield (8-layer) | ✅ Production |
| Live TVEC kill switch | Real-time transcription + AI | ✅ Verified < 10 seconds |
| Bot detection | Sentinel | ✅ Production |
| Mental health escalation | Candor Beacon | ✅ Production |
| Broadcast integrity | Verify | ✅ Production |
PhotoDNA fails closed — if the CSAM screening service is unreachable, the upload is blocked. ThreatShield fail mode is configurable per deployment via THREATSHIELD_FAIL_MODE.
CSAM compliance: All detected material is immediately quarantined, never stored in the feed database, and reported to NCMEC within 24 hours under 18 U.S.C. § 2258A.
Candor collects no personally identifiable information. Identity is cryptographic.
- Ed25519 keypairs generated client-side at registration
- BIP-39 seed phrase for account recovery — never stored server-side
- User hash (one-way) used for safety case tracking only
- No email required for standard or anonymous tiers
- ZK age proofs for adult verification — we never see the underlying ID
Account tiers:
| Tier | Privacy | Use Case |
|---|---|---|
| Standard | Username + Ed25519 key | General community |
| Anonymous | Zero PII, deterministic DID | Privacy-conscious users |
| Whistleblower | AES-256-GCM E2E + anonymous routing | Source protection |
- Node.js 20+
- PostgreSQL 16+
- Redis 7+
git clone https://github.com/CandorNetwork/candor-platform.git
cd candor-platform/services/feed
npm installcp .env.example .env
# Edit .env with your valuesMinimum required environment variables:
NODE_ENV=production
FEED_PORT=3001
DATABASE_URL=postgresql://user:password@localhost:5432/candor_feed
REDIS_URL=redis://:password@127.0.0.1:6379
JWT_SECRET=your-secret-hereOptional (required for full safety pipeline):
SHIELD_URL=https://your-threatshield-instance.fly.dev
PHOTODNA_URL=https://your-photodna-instance.fly.dev
INTERNAL_AUTH_TOKEN=your-internal-tokennode migrate.js # Create database schema
node index.js # Start feed server# See docs/deployment.md for full systemd service setupcandor-platform/
├── services/
│ └── feed/
│ ├── index.js # Feed server — posts, auth, feed ranking
│ ├── cache.js # Redis cache layer
│ ├── migrate.js # Database schema migrations
│ ├── news-bots.js # Automated news feed accounts
│ ├── package.json
│ ├── .env.example
│ └── lib/
│ └── safety-client.js # HTTP bridge to safety microservices
├── frontend/
│ └── open-feed-algorithm.jsx # Interactive OFA demo (React)
├── docs/
│ ├── architecture.md
│ ├── safety-pipeline.md
│ ├── deployment.md
│ └── api-reference.md
├── CONTRIBUTING.md
├── ROADMAP.md
├── CHANGELOG.md
├── SECURITY.md
└── LICENSE
The following components are maintained as closed-source safety infrastructure:
- ThreatShield — TVEC and extremism detection (dual-model AI, GIFCT integration)
- Guardian Shield — 8-layer child protection system
- Candor Beacon — Mental health escalation and crisis routing
- Beacon FR — First responder peer support (employment-protected)
- Sentinel — Bot and coordinated inauthentic behavior detection
- Verify — Real-time broadcast integrity (EN/ES)
- PhotoDNA integration — CSAM hash screening (Microsoft-licensed)
- Crypto identity system — Ed25519 keygen, BIP-39 recovery, onboarding
These services are accessible via the safety-client.js HTTP interface if you operate your own safety layer, or contact us at safety@openfeed.network for integration inquiries.
Candor is in active technical partnership discussions with the Global Internet Forum to Counter Terrorism (GIFCT). Our TVEC detection pipeline integrates with GIFCT's Hash Matching API (HMA) and Content Incident Protocol (CIP).
Current status:
- HMA integration: wired, awaiting production credentials
- CIP integration: wired, awaiting production credentials
- TVEC kill switch: verified < 10 seconds end-to-end on live streams
- Detection coverage: English and Spanish
Open Feed Network, Inc. is actively pursuing grants from:
- Knight Foundation — Informed & Engaged Communities
- Mozilla Technology Fund — Trustworthy AI
- Democracy Fund — Strengthen Democratic Discourse
- Craig Newmark Philanthropies — Trustworthy Information
All contributions welcome. See CONTRIBUTING.md for guidelines.
Algorithm weight changes require a community governance vote and are tracked in the governance log. No single entity — including Open Feed Network, Inc. — can change feed ranking weights unilaterally.
Open Feed Network, Inc. Wyoming C-Corp · Founded May 2026 candortheopenfeednetwork.com · candornetwork.is safety@openfeed.network · legal@openfeed.network
MIT License — see LICENSE for details.
The safety microservices (ThreatShield, Guardian Shield, Beacon, Sentinel, Verify, PhotoDNA integration) are proprietary and not covered by this license.
Candor: The Open Feed Network — Truth through transparency, not suppression.