Community Engagement & Governance Overview
Once your documentation site or technical blog grows an active readership, there is no need to migrate stacks or bolt on third-party comment widgets. Enable the accounts, course, or payments Cargo features and connect PostgreSQL to unlock built-in community interaction and monetization.
Core Design Principles
- Security Built In from Day One:
- Full OAuth2 + PKCE + State validation across all identity providers;
HttpOnly + SameSite=Lax + SecureJWT cookies, with logout strictly enforcingPOSTand same-origin headers against cross-site logout CSRF;- Strict CSP without
'unsafe-eval'plus per-IP token-bucket rate limiting on/api/*.
- Discussions Anchored to Content: Forum threads live both on
/topicsand inside contextualDiscussionPanelfooters on individual doc pages and showcase items, turning reader questions into searchable community Q&A. - Fail-Safe Content Moderation: Built-in URL blocklists combine with optional OpenAI/Anthropic-compatible LLM scoring. Whenever an upstream LLM times out or fails, submissions default to manual review or rejection — never fail-open.

