Notes from building Haven
How we make safety decisions, what we got wrong, and what is still missing.
Why we create guardian links by hand
A link that grants access to a child's private messages is only as safe as the person holding it. The person most likely to ask a child for that link is exactly the person the protection exists to stop.
Why we test the impossible stays impossible
Access rules live in the database, not the interface. Proving the rules work is the easy half — the half that caught us out was proving the wrong caller still cannot reach them.
Why messaging is deliberately narrow
A teacher can message a student only if that student enrolled with them. That is the whole rule, and nearly everything uncomfortable about Haven Chat follows from keeping it.
Publishing our gaps before our audit
We have not been audited, so we do not claim conformance. Here is the list of what we know is broken, including the one that needs Haven's palette changed.
What it costs to let a sixteen-year-old teach calculus
The conviction the whole platform was built around, and the specific things it cost: manual guardian links, masked names, guardian-held payout accounts, and a much harder product.
The decisions these posts describe are already documented across the site.