shouldiuse.io

VERDICT

Should I use Discourse?

Skip to main content - discourse.nixos.org

Depends. Buy it if you run a serious community needing searchable, long-form discussion — NixOS's own forum proves the model. Skip it if you want quick team chat; Discord or Flarum is less work.

Confidence

Medium. Based on ~11 usable public sources; several search results were irrelevant 'discourse analysis' pages and were excluded. Pricing figures were not disclosed in the snippets reviewed.

Ratings

  • Value for money
  • Ease of use
  • Feature depth
  • Support qualityNo evidence in sources reviewed
  • Security posture

Pricing

$0

Free

ModelNot disclosed
Monthly feesNot disclosed
HardwareNot disclosed
Free tierYes
Managed hostingNot disclosed in sources reviewed

Best for

  • Open-source project communities
  • Docs-heavy support forums
  • Large developer ecosystems
  • Self-hosters wanting full control

Not for

  • Small teams wanting quick casual chat
  • Anyone unwilling to moderate or administer a forum
  • Real-time-first communities (use Discord)
  • Buyers wanting a set-and-forget, no-admin forum

Gotchas - check before you buy

high

Self-hosting means you own patching; older instances publicly flagged as vulnerable

medium

No obvious cheap hosted tier; users debate cheapest ways to run it

medium

Plugins expand attack surface; a 2025 plugin CVE needed detection guidance

medium

Free plan is real but limited; full power means paid hosting or sysadmin work

Pros and cons

Pros

  • Free plan available straight from Discourse
  • G2 reviewers call it easy to use
  • Highly customizable, open source with plugins
  • Wide adoption: 7,401+ companies tracked
  • Runs a public bug bounty on HackerOne

Cons

  • Recurring CVEs, including a 2026 authentication bypass
  • Unauthenticated chat message access exploit for 3.1.1
  • Backup disclosure flaw via Rails send_file quirk
  • Self-hosters publicly warned about vulnerable older instances
  • Managed hosting costs push buyers hunting cheaper routes

Sources & method

Analyzed 9/27/2026 - 11 sources - Actively maintained with a bug bounty, but a steady CVE stream 2024–2026 including auth bypass and unauthenticated chat access.

official x2review x3security x4news x2
  • CVE-2026-27454: Auth bypass, Discourse authentication bypass vulnerability disclosed March 2026.
  • CVE-2024-53991: Backup disclosure, Rails send_file quirk could expose backups; flagged as urgent for self-hosters.
  • Unauthenticated chat access (3.1.1), Exploit for unauthenticated chat message access listed July 2025.
  • CVE-2025-46824: Plugin vulnerability, Plugin vulnerability with public detection guidance, August 2025.

Key stats

  • Value for money: 3/5

    Rating

  • $0

    Starting price

  • 11

    Sources

  • Analyzed

  • Value for money: 3/5. Free self-host option; hosted costs draw complaints
  • Ease of use: 4/5. G2 reviewers call it easy to use
  • Feature depth: 4/5. Official site touts customization; plugin ecosystem exists
  • Support quality. No evidence in sources reviewed
  • Security posture: 3/5. Bug bounty active, but recurring CVEs incl. auth bypass
  • 7,401+ Companies using tracked by TheirStack
  • $21M+ Total funding per PitchBook
  • Yes Free tier official free plan
  • 4 CVEs Security advisories 2024–2026, incl. auth bypass

Pricing

Free

$0

  • Official free plan
  • Real Discourse, free per vendor

Managed hosting

Not disclosed

  • Official pricing page lists hosting plans
  • Third-party hosts (e.g. Elestio, CloudClusters) also sell it

Security

Actively maintained with a bug bounty, but a steady CVE stream 2024–2026 including auth bypass and unauthenticated chat access.

  • CVE-2026-27454: Auth bypassDiscourse authentication bypass vulnerability disclosed March 2026.⁴
  • CVE-2024-53991: Backup disclosureRails send_file quirk could expose backups; flagged as urgent for self-hosters.⁵
  • Unauthenticated chat access (3.1.1)Exploit for unauthenticated chat message access listed July 2025.⁶
  • CVE-2025-46824: Plugin vulnerabilityPlugin vulnerability with public detection guidance, August 2025.

What users say

G2 reviewers describe Discourse as easy to use and simple yet capable, while Hacker News and self-hosting threads show cost and admin-burden gripes.

Alternatives

Compare Discourse with each alternative.

  • Flarum

    Lighter open-source forum; simpler to run than Discourse.

  • Talkyard

    Forum-plus-chat hybrid positioned as a Discourse alternative.

  • BetterMode

    No-code community platform; less technical overhead.

    Discourse vs BetterMode

  • Discord

    Free real-time chat; worse search, zero admin burden.

Companies that use it

  • NixOS
Full analysis

Based on ~11 usable public sources; several search results were irrelevant 'discourse analysis' pages and were excluded. Pricing figures were not disclosed in the snippets reviewed.

Proven open-source forum for real communities (NixOS runs it); heavy and admin-needy for small teams.

Methodology

Based on ~11 usable public sources; several search results were irrelevant 'discourse analysis' pages and were excluded. Pricing figures were not disclosed in the snippets reviewed.

Sources

  1. Discourse Reviews — G2g2.com
    review
  2. Discourse Pricing (official)discourse.org
    official
  3. Discourse Free Plan (official)discourse.org
    official
  4. CVE-2026-27454: Auth Bypass — SentinelOnesentinelone.com
    security
  5. CVE-2024-53991 Backup Disclosure — ProjectDiscoveryprojectdiscovery.io
    security
  6. Discourse 3.1.1 Unauthenticated Chat Access — Exploit-DBexploit-db.com
    security
  7. Discourse Bug Bounty — HackerOnehackerone.com
    security
  8. Companies that use Discourse — TheirStacktheirstack.com
    news
  9. Discourse Funding — PitchBookpitchbook.com
    news
  10. Cheapest way to run Discourse — Metameta.discourse.org
    review
  11. Discourse vs alternatives — Level1Techs communityforum.level1techs.com
    review

Rate this review

Anonymous. You can change your vote.

Loading votes…

Comments

One queue. No nested comments. Give a display name first. Limit: 200 words per comment and 7 comments per day. You can edit or delete yours.

Save a name to write a comment.

0 / 200 words

No comments yet.