KMegle

KMegle pairs IIIT Kottayam students for anonymous video chat. Video and audio run entirely over WebRTC peer-to-peer — they never touch the backend, which means zero video-storage liability and zero media bandwidth cost for the server. The backend's only job is matchmaking, presence and the ban list.

The first optimization pass replaced an O(n²) per-candidate-pair block check with one blocklist query per queued user — a real improvement on paper. Load-testing against a real backend showed the actual bottleneck was somewhere else entirely: the matchmaker processes its whole queue under a single lock, one await at a time, so N sequential DB round-trips become the bottleneck once the queue hits a few hundred users, independent of the algorithm.

The fix was a single set-based query — one WHERE blocker_id = ANY($1) OR blocked_id = ANY($1) for the entire queue per matching pass — making DB round-trips O(1) regardless of queue size or block density. Both versions are benchmarked with reproducible scripts and the raw results are committed alongside the code, not just asserted.

A MobileNetV2-based NSFW classifier runs client-side via TensorFlow.js, sampling frames at roughly 3.3Hz. A sliding window over the last 6 samples requires multiple violations before it warns or auto-bans, which cuts false positives from a single bad frame. Nothing is ever uploaded to check it — the moderation model runs on the viewer's own device.

The frontend sits on Vercel, and Next.js rewrites proxy all API and Socket.IO traffic through it to the Render backend — the browser never makes a direct request to the backend's real hostname, which hides it from casual discovery and sidesteps ISP/campus DNS blocks on the hosting domain. CORS only allows the deployed frontend and localhost, and admin endpoints require a separate key header.

The project has also been through a full internal security audit with a written remediation plan, covering the gaps you'd expect in a real-time, anonymous, campus-facing app.

KMegle hasn't launched to students yet. Load tests show a single small Render instance comfortably holds 500–1,500 concurrent socket connections — the real limiting factor at scale is TURN relay bandwidth for the minority of peers that can't connect directly, not the Node backend. The code is public.