Lemmy
join-lemmy.orgA federated, open-source link aggregator and discussion platform, similar to Reddit. Built on ActivityPub. Wide range of cross-platform client apps.
- Homepage: join-lemmy.org
- GitHub: github.com/LemmyNet/lemmy
- Android App: play.google.com/.../com.jerboa
- Web info: web-check.xyz/check/join-lemmy.org
Lemmy Source Code
Author
Description
๐ A decentralised discussion platform for communities.
Homepage
https://join-lemmy.orgLicense
AGPL-3.0
Created
14 Feb 19
Last Updated
20 Jul 26
Latest version
Primary Language
Rust
Size
39,629 KB
Stars
14,509
Forks
960
Watchers
14,509
Language Usage
Star History
Top Contributors
-
@dessalines (2988)
-
@Nutomic (1577)
-
@renovate[bot] (139)
-
@dullbananas (92)
-
@phiresky (72)
-
@SleeplessOne1917 (56)
-
@StaticallyTypedRice (43)
-
@asonix (38)
-
@flamingos-cant (20)
-
@sunaurus (18)
-
@AutomCoding (18)
-
@IngrownMink4 (14)
-
@eiknat (14)
-
@Nothing4You (13)
-
@AndreVallestero (11)
-
@masterstur (11)
-
@ernestwisniewski (11)
-
@zeroone2numeral2 (10)
-
@matc-pub (9)
-
@maxigaz (9)
-
@iav (8)
-
@Filip785 (8)
-
@ralyodio (8)
-
@teromene (7)
-
@makotech222 (6)
-
@kroese (6)
-
@cetra3 (6)
-
@kartikynwa (6)
-
@knkski (5)
-
@fvanzee (5)
-
@niniack (5)
-
@vpzomtrrfrt (5)
-
@zautumnz (5)
-
@sylviaji (5)
-
@robjtede (5)
-
@Txopi (4)
-
@TKilFree (4)
-
@iByteABit256 (4)
-
@panosalevropoulos (4)
-
@MV-GH (4)
-
@Earthbadgerr (4)
-
@olle-app (4)
-
@Kradyz (4)
-
@KitaitiMakoto (4)
-
@franrgb (4)
-
@Integral-Tech (4)
-
@thedaviddelta (4)
-
@CobaltCause (4)
-
@tooclassyforthisworld (4)
-
@Mart-Bogdan (4)
-
@momentary-lapse (4)
-
@6543 (3)
-
@Rynach (3)
-
@pioneer (3)
-
@dependabot[bot] (3)
-
@dioraman (3)
-
@kleeon (3)
-
@lambeolino (3)
-
@sam365724 (3)
-
@tracyspacy (3)
-
@ahangarha (3)
-
@phanky1 (3)
-
@mlaunois (3)
-
@smorks (3)
-
@Elara6331 (3)
-
@TinfoilSubmarine (3)
-
@jmarthernandez (3)
-
@Trombach (3)
-
@pijuszczyk (3)
-
@Noisytoot (3)
-
@ptman (3)
-
@paolobarbolini (3)
-
@ninanator (3)
-
@kukumaka (3)
-
@shilangyu (3)
-
@Whayme (2)
-
@scme0 (2)
-
@dogeek (2)
-
@SorteKanin (2)
-
@tafiti (2)
-
@Tmpod (2)
-
@vijaykramesh (2)
-
@w-k-s (2)
-
@biosfood (2)
-
@c-andy-candies (2)
-
@dayinjing (2)
-
@jim-taylor-business (2)
-
@Jonnnh (2)
-
@nixoye (2)
-
@perillamint (2)
-
@scarlet-tobar (2)
-
@tqcenglish (2)
-
@ismailkarsli (2)
-
@operagxoksana (2)
-
@Axighi (2)
-
@alexandrupero (2)
-
@adamsky (2)
-
@guland2000 (2)
-
@ajyoon (2)
-
@uuttff8 (2)
Recent Commits
-
Pavlos Smith (14 Jul 26)
Add report resolve reason (#6612) * Added report resolve reason fields, work in progress * Report resolve reason works, federation and notification TODO * Removed TODO comments, fixed tests * sql format
-
Nutomic (14 Jul 26)
Handle create post activity from Mitra (fixes #6577) (#6611)
-
Nutomic (10 Jul 26)
Switch to jemalloc (#6608)
-
Nutomic (06 Jul 26)
Change more activity types to accept both id or embed (fixes #2106) (#6600) * Change more activity types to accept both id or embed (fixes #2106) * clippy
-
Nutomic (06 Jul 26)
Fix for accepting Mitra create activity (fixes #6577) (#6601)
-
Nutomic (03 Jul 26)
Proper fix for accept activity with object id (fixes 6595) (#6599) * Proper fix for accept activity with object id (fixes #6595) * cleanup
-
Dessalines (03 Jul 26)
Add typos check to CI. (#6560) * Add typos check to CI. * Move below prettier * Also exclude readmes * Running typos * A few more * No reason to use nightly rust image for typos.
-
Felix Ableitner (03 Jul 26)
Version 1.0.0-beta.1
-
Nutomic (30 Jun 26)
Fix private message sending from 0.19 to 1.0 (fixes #6591) (#6597)
-
Nutomic (29 Jun 26)
Handle accept activity with object id (fixes 6595) (#6596)
-
Dessalines (23 Jun 26)
Adding community moderators to GetPost (#6593) - Fixes #6592
-
Waqqas Sheikh (22 Jun 26)
Update activity count of dead communities (fixes #5794) (#6589) The `community_aggregates_activity` function returns a mapping of community and activity count. A scheduled task updates the community record with the activity count. The query used in `community_aggregates_activity` mistakenly omits dead communities. This causes the recorded activity count to go stale which causes the issue. The fix is to add an update query at the end of the scheduled task that resets the activity count to 0 for those communities that were not returned by the query.
-
Waqqas Sheikh (16 Jun 26)
Adds additional attachments to end of post (fixes #6229) (#6585) * Adds additional attachments to end of post (fixes #6229) When activities of posts have both an image and a link attachment, lemmy only takes the image attachment. The link attachment is dropped. The solution is to add the additional links at the end of the post body (similar to how multiple attachments are handled for comments) This fixes issue 6229. * Address lint issues (needless borrow) * Remove test comment that documents old behavior
-
Nutomic (16 Jun 26)
Federate warnings (fixes #6326) (#6582) * Federate warnings (fixes #6326) * clippy * Apply suggestion from @dessalines Co-authored-by: Dessalines <[email protected]> * fixes --------- Co-authored-by: Dessalines <[email protected]>
-
Nutomic (09 Jun 26)
Fix for private community accept federation (fixes #6576) (#6580) * Fix for private community accept federation (fixes #6576) * fmt
-
Nutomic (09 Jun 26)
Remove duplicate schema entry (#6579)
-
Nutomic (09 Jun 26)
Auto-approve private comm follows for admins/mods (#6578)
-
Dessalines (09 Jun 26)
Add child_count to modlog, used for bulk_action_parents. (#6569) * Add child_count to modlog, used for bulk_action_parents. - Adds a child_count column to modlog, default 0. - Adds an SQL trigger, that increments the modlog child count for the parent. - Adds a few tests to make sure that inserted children are correctly incrementing this count. - Fixes #6563 * Remove child count default in form * Decrement child count on row delete
-
Nutomic (08 Jun 26)
In nginx config use `$remote_addr` (#6575)
-
Dessalines (08 Jun 26)
Include your own private messages when using creator_id filter. (#6572) - Fixes #6571
-
Nutomic (05 Jun 26)
Feature flag for plugins (#6570) * Feature flag for plugins * error if plugins configured * clippy
-
Dessalines (04 Jun 26)
Splitting out show_media and hide_posts_with_media user settings. (#6566) - Fixes #6564
-
Nutomic (04 Jun 26)
Use correct Activitypub id for private community follow Accept/Reject (fixes #6561) (#6562) * Use correct Activitypub id for private community follow Accept/Reject (fixes #6561) * fmt * fix sql * add comment
-
Dessalines (04 Jun 26)
Adding post filtering by tag. (#6567) * Filter post listing by tag (fixes #6505) * Fixing the tags filter * Update comment. * Fixing the tags filter (#6510) * Fixing the tags filter * Update comment. * test case * Adding post filtering by tag. - Fixes #6505 * Fixing import --------- Co-authored-by: Felix Ableitner <[email protected]>
-
Nutomic (02 Jun 26)
Add missing permission checks for private community (fixes #6529) (#6559)
-
Nutomic (02 Jun 26)
Federate private message reports (fixes #4436) (#6557) * Federate private message reports (fixes #4436) * also federate resolve * fix test
-
Nutomic (02 Jun 26)
Remove wrong community title check (#6558)
-
Dessalines (02 Jun 26)
Adding a few lemmy_api_common exports needed for lemmy-rs-client. (#6551) * Adding a few more API exports * Add post warning and post response * Adding create comment warning and lock * Version 1.0.0-alpha.20 * Try to fix cargo publish 1 * Comment out others temp * Version 1.0.0-test-fix-publish-1 * Version 1.0.0-test-fix-publish-2 * Version 1.0.0-test-fix-publish-3 * Revert "Comment out others temp" This reverts commit b731274485d277d32083ef5846c7e89768cefd89.
-
Nutomic (01 Jun 26)
Prevent user enumeration via login endpoint (#6531) * Prevent user enumeration via login endpoint * clippy * change error * change dummy hash * spawn_blocking * clippy
-
Nutomic (01 Jun 26)
Dont show community mods in pending follows list (fixes #6549) (#6556)
Lemmy Security
Security Advisories (23)
- medium Patched
CVE-2026-54738 Rate limit bypass via X-Forwarded-For header spoofing in actix-web ConnectionInfo
- low Patched
CVE-2026-54743 Stored XSS via markdown image alt-text in lemmy-ui html5-embed
- medium Patched
CVE-2026-54739 Login Endpoint User Enumeration via HTTP Response Code Differential
- low Patched
GHSA-5qxq-g3f3-57p5 Multi-community `Update` has no actor authorization
- low Patched
GHSA-9wj2-3cv5-cqrx Private community profile and moderators leak via federation HTTP
- low Unpatched
CVE-2026-54742 `CollectionAdd::Featured` does not check the post is in the community
- low Patched
GHSA-95q8-x6r6-672m Private community data exposed through community, saved, liked, and modlog API views
- low Patched
CVE-2026-54741 Blocked users can edit private messages sent before the block
- low Patched
GHSA-jmxc-hhwx-gvv3 Private Lemmy instances expose multi-community metadata without authentication
- medium Patched CVSS 6.5
CVE-2026-54740 Lower-ranked federated moderator can remove higher-ranked moderators
- low Patched
GHSA-vh35-q865-92vr Federated Block activity can ban local users without site admin authorization
- low Patched
GHSA-qxrw-f6fh-34r7 Resend verification endpoint exposes registered email addresses
- medium Unpatched CVSS 6.3
CVE-2026-42180 SSRF in /api/v3/post via Webmention dispatch
- medium Unpatched CVSS 6.5
CVE-2026-42181 SSRF and internal image disclosure in post link metadata via unvalidated og:image
- low Unpatched
GHSA-c482-7gjx-pp36 Blind SSRF in /api/v3/resolve_object, normal user can reach internal services and make outbound requests
- medium Patched CVSS 6.5
CVE-2026-33693 SSRF via 0.0.0.0 bypass in activitypub-federation-rust v4_is_invalid()
- medium Patched
CVE-2026-29178 Unauthenticated SSRF via file_type query parameter injection in image endpoint
- low Patched
GHSA-x57w-mr53-3f5h DB performance issues
- medium Patched
GHSA-373q-r73m-8mrg Local users can delete arbitrary entries from the local_image table
- medium Patched
GHSA-7xwp-jqhc-v6vw Local users can delete arbitrary pict-rs media
- medium Patched
GHSA-wr2m-38xh-rpc9 Purging users or communities or banning users can delete images they didn't upload/exclusively use
- medium Unpatched CVSS 4
CVE-2025-25194 Server-Side Request Forgery (SSRF) in activitypub_federation
- high Patched CVSS 7.5
CVE-2024-23649 Any authenticated user may obtain private message details from other users on the same instance
Lemmy Website
Website
Lemmy - A decentralised discussion platform for communities
Lemmy
Redirects
Does not redirect
Security Checks
All 65 security checks passed
Server Details
- IP Address 65.21.61.25
- Hostname static.25.61.21.65.clients.your-server.de
- Location Helsinki, Uusimaa, Finland, EU
- ISP Hetzner Online GmbH
- ASN AS24940
Associated Countries
-
US -
FI
Safety Score
Website marked as safe
100%
Blacklist Check
join-lemmy.org was found on 0 blacklists
- AntiSocial Blacklist
- Artists Against 419
- Badbitcoin
- Bambenek Consulting
- CERT Polska
- CoinBlockerLists
- CRDF
- CryptoScamDB
- EtherAddressLookup
- EtherScamDB
- Fake Website Buster
- MetaMask EthPhishing
- NABP Not Recommended Sites
- OpenPhish
- PetScams
- PhishFeed
- PhishFort
- Phishing.Database
- PhishStats
- PhishTank
- Phishunt
- RPiList Not Serious
- Scam.Directory
- SecureReload Phishing List
- Spam404
- StopGunScams
- Suspicious Hosting IP
- ThreatFox
- ThreatLog
- TweetFeed
- URLhaus
- ViriBack C2 Tracker
Website Preview
Lemmy Android App
APK Info
- App Jerboa
- Creation Date 31 May 24
- Last Updated 14 Jul 24
- Current Version 0.0.66
- Privacy Report View on Exodus โ
De-Googled Compatibility
- GrapheneOS Native 4.0 / 4 (2)
- LineageOS microG 4.0 / 4 (2)
Trackers
No trackers found
Permissions
- Access Network State
- Internet
- Read External Storage
- Read Media Audio
- Read Media Images
- Read Media Video
- Write External Storage
- Dynamic Receiver Not Exported Permission
Lemmy Reviews
More Social Networks
-
A fully open-source, self-hostable discussion platform usable as a mailing list, discussion forum, or long-form chat room.
-
An open-source, distributed social media platform functioning similarly to Twitter, without algorithmic timeline manipulations. It operates across independent servers.
-
nostr stands for Notes and other stuff transmitted by relays. It is an open protocol, not merely a platform. This distinction enables truly censorship-resistant and global value-for-value publishing on the web. With the power to replace data-greedy applications like Twitter and Instagram, nostr offers a promising alternative for users seeking a more private and secure online experience without algorithmic manipulations. ".... I feel like Iโm looking at the future." that is what Snowden wrote about nostr.
About the Data: Lemmy
Change History
- Added #496
API
You can access Lemmy's data programmatically via our API. Simply make a GET request to:
https://api.awesome-privacy.xyz/v1/services/lemmy The REST API is free, no-auth and CORS-enabled. To learn more, view the API Docs or read the API Usage Guide.
Share Lemmy
Help your friends compare Social Networks, and pick
privacy-respecting software and services.
Share Lemmy and Awesome Privacy with your network!