4.5k stars · AGPL-3.0 · v0.36.1 (2026-07-03) · Track this in Rising ↗
Self-hosted public feedback board — a roadmap that builds trust, and user language that doubles as keyword research.
Radar check
What we found when we opened it. Every bar is one fact, with its date.
Last code pushed 21 Oct 2026, 6 days before this check.
Latest release v0.38.2 on 5 Oct 2026.
Public since January 2017, a little over 9 years.
4,589 stars and 871 forks.
139 commits and 15 new issues in the last 90 days.
79 contributors. 43 pull requests merged in 90 days.
A security policy says how to report a problem. 12 published security advisories.
How the bars are scored
- Alive. Days since the last code push: a week or less 100, a month 90, three months 70, six months 50, a year 30, eighteen months 15, older 0.
- Releases. Age of the latest GitHub release, on a similar scale; no bar when the project publishes no releases.
- Maturity. Age of the project: eight years 100, five 90, three 70, two 55, one 40, six months 25, younger 10.
- Adoption. Stars on a log scale: 100,000 stars is 100, 10,000 is 80, 1,000 is 60, 100 is 40.
- Activity. Commits in the last 90 days: 300 or more 100, 100 85, 30 65, 10 45, any 25.
- Community. People who have contributed: 100 or more 100, 30 80, 10 60, 5 40, 2 25, one 10.
- Security. A published security policy 80, none 40; published advisories are listed, not scored.
Checked by Repo Radar on 26 Oct 2026 from the repository on GitHub. Covered in Edition 46.
▶Repo detailsthe review · specs · pros & cons · install
What it does
Fider puts up a public board at an address you choose. Anyone who signs in can post an idea, vote on anybody else's, and reply in a threaded comment. The person running the board gives each post a status and writes an official response, which sends an email to everyone who voted and can also send a message to another system through a webhook. Each board gets its own title, welcome message, branding and shareable link, and search across posts. Posts can be tagged and grouped. Signing in is by a link emailed to you, with optional sign-in through Google, GitHub or Facebook; voting requires being signed in, which is deliberate — it is what stops one person voting fifty times — and it is also the main thing people grumble about. It is translated into several languages, and a multi-board mode serves separate boards on separate subdomains. It ships as a single program written in Go serving a browser interface, backed by PostgreSQL 12 or newer, distributed as a container. It will not run usefully without an outbound email provider — one of SMTP, Mailgun or Amazon SES is mandatory and the no-reply address has no default. It is not a help desk: there are no agents, queues, assignment, service-level targets, canned replies or private one-to-one conversations, because everything on it is public. It is not a live chat widget and not a customer-records system. There is no built-in roadmap board, no mobile app and no in-application widget — you send people a link.
Why it matters
Who it suits. Anyone shipping software to more than a few dozen people who is currently guessing what to build next, and who would rather have the argument in public than in a support inbox. It suits open-source maintainers particularly well, because the board doubles as a filter: an idea nobody votes for is an answer in itself. Skip it if what you actually need is a ticket queue with assignment and private threads — that is a different product — and skip it if you have no way to send email.
What people say. Independent editorial coverage of Fider is genuinely thin for a nine-year-old project, and we would rather say so than pad it. The one real hands-on account is by Isaac Johnson, a named cloud architect, at freshbrewed.science on 3 June 2025, and it is useful precisely because it is critical: his container kept crashing until he filled in the mail settings, he found the email verification for the first administrator "seems silly", the verification message never arrived and he had to dig the link out of his mail provider's logs, and he noted that the sign-in-by-email model "might be a challenge". His conclusion after moving it to Kubernetes with a mail provider and TLS was "Once in Kubernetes, it worked like a charm". He sells nothing and has no connection to the project. The second useful source is the project's own security record: advisory GHSA-wjrq-7x2x-9p48, published 5 October 2026, was reported by an outside researcher and describes unescaped user names and post titles landing misleading links in other people's notifications; it was patched the same day in version 0.38.2, with an honest note that notifications created before the upgrade are not rewritten. Fider also appears as a one-click template on several hosting platforms — Railway, Hostinger, Dokploy — which is evidence of distribution rather than quality, and every one of those companies makes money when you deploy through them.
Verdict. The most complete product in this edition, and the reason it earns a second outing: nine years old, code pushed the day before this was written, a release five days before that whose headline content is two externally reported security fixes plus a hardening pass, and 31 open issues against 4,572 stars — a tracker somebody is grooming rather than abandoning. Run it for an evening and the hard part is the mail provider, not the software. Four practical warnings. Encryption is off by default and the program binds every network interface on port 3000, with the documented container mapping that to port 80, so put a proxy in front. Signups are open by default. The docker-compose.yml in the repository is a development file full of hardcoded passwords — do not deploy it. And there is no latest tag on its container registry, so pin a version. The closest alternatives are logchimp/logchimp and clearflask/clearflask; the second is Apache-2.0 rather than AGPL, which matters if the network clause is a problem.
Summary (Key Points)from the README
Key features
- Feedback portal: Collects feature requests and suggestions from customers, so teams can see what users need.
- Fully managed cloud option: Fider Cloud is run by the creators of Fider, who handle software updates and patches.
- Free self-hosting: Self-hosted Fider is free to install on your own servers and infrastructure.
- Quick start: Fider Cloud is described as a way to get started in minutes.
- Donations at any size: Donations can be set up as small or large as the donor wants to support development.
- Sponsor recognition: Organizations that set up a monthly donation can get their logo and link on the README.
- Open contribution: A CONTRIBUTING guide explains how to contribute, and the README credits its contributors.
Ways to install
| Platform or method | What it needs | Effort |
|---|---|---|
| Fider Cloud (managed) | A sign-up to the managed service | Low: the creators run the service, including updates and patches |
| Self-Hosted | Your own servers and infrastructure, plus the setup guide the README links to | High: you are responsible for running and maintaining everything |
Important
- Self-hosting responsibility: The README states that self-hosting is free, but you are responsible for everything, including software updates and patches.
- Cloud is a managed service: Fider Cloud is run by the creators, so it is the lower-effort choice if you do not want to manage infrastructure.
- Donations are optional: Support and sponsorship are voluntary, and the README does not describe any paid features or tiers.
- Limited detail in the README: It does not list system requirements, supported platforms, or the specific setup steps, so check the linked docs before self-hosting.
Written by an AI model from the project’s README; not part of the review, and it can be wrong.
- Plain unmodified AGPL-3.0 read from the file, with no added conditions. The 250-item limit and the paid tier belong to the company's hosted service, not to the licence or the self-hosted version.
- Hardening defaults that are right rather than convenient: no shipped credential, a signing secret that is mandatory with no default so it cannot start with a baked-in key, outbound webhooks blocked from reaching private networks, the measurements endpoint off, and a 25 MB request limit and iframe restrictions added in the newest release.
- A tidy project: 31 open issues on a nine-year-old repository with 4,572 stars, an outside security report patched the same day it was published, and no
curl … | bashanywhere in the install.
- It does nothing without an email provider. One of SMTP, Mailgun or Amazon SES is mandatory, the no-reply address has no default, and the first administrator is created by a code sent in an email — which one named reviewer never received.
- Encryption is off by default, it binds every network interface, and new signups are open by default. The repository's own compose file is for development and ships a database password of
fider_pw. - Voting requires signing in, which keeps the numbers honest and loses you the casual vote. And there is no
latestcontainer tag, so an unpinned pull does not resolve the way most people assume.
That is the exact vocabulary you should be feeding into OpenSEO (Edition 2) as keyword seeds, and the exact phrasing your landing page should be using instead of yours.
logchimp/logchimpThe same public voting board in Node and Vue rather than Go, current but with 144 open issues on a quarter of the stars and no versioned releases at all.
Track this in Rising ↗
clearflask/clearflaskThe same feedback-and-roadmap idea under Apache-2.0 rather than AGPL, which matters if the network clause is a problem; heavier stack and no versioned releases.
Track this in Rising ↗- astuto/astuto
The obvious smaller competitor, archived by its owner on 8 February 2026 with a README saying it is no longer maintained.
Track this in Rising ↗
docker compose pull docker compose up -d docker compose logs app
