dev3lop

We ran a three-pass audit of the j7 codebase — one sweep each for the backend, the web/SEO layer, and data integrity — then shipped every fix the same day. This is the engineering log.

The one that mattered: a stored XSS

Our inline-markdown renderer escaped &, <, and > before turning [text](url) into a link — but not the double-quote. A crafted URL could close the href attribute and inject an event handler that runs in a reader's session. Because posts have a collaborator invite flow, this was a genuine stored XSS, not merely self-XSS. The fix: escape quotes before applying markup and exclude quotes from the URL match — in both the Astro and React renderers, which stay in lockstep.

Highs — one request should never be able to hurt the box

j7's backend runs on a deliberately tiny box, so the bar is simple: no single request may pin the CPU or exhaust memory.

• Image uploads reject over-40MP inputs before decode (a small-on-disk decompression bomb used to expand to over a gigabyte of raw pixels) and optimize one at a time.
• A hard 16MB request-body ceiling, an error-net so a stray throw can't crash a path, and a SQLite busy-timeout instead of instant lock errors.
• The public compute-heavy endpoints (leaderboard, stats) are cached; the on-demand social-card renderer sheds load past a concurrency cap.
• Owner lookups moved from scanning every space to an indexed column, and 'where is this image used' is now owner-scoped and auth-gated.

Before / after

Content is now bounded

Every block that holds a collection — table rows, list items, schedule events — now has a size cap enforced at save time, and event colors are validated to a hex value so they can't be used as a CSS-injection vector. A malformed or oversized draft is rejected before it can bloat storage or every future page render.

The quiet efficiency wins

• Space resolution is cached, so a cold-cache render stops re-asking the backend who owns the host.
• A/B-experiment lookups are negative-cached for 60s — most posts have no experiment, so that per-view round-trip is gone.
• Every cross-service fetch now has a timeout, so a hung backend can't stall a page render forever.
• The editor's crash-recovery backstop no longer serializes the whole document to disk on every keystroke.

None of this changes what j7 does. It changes how much it can take before it flinches — which is the whole point of a hardening pass. Onward.

A contact page is the highest-leverage page on a site — it's where interest turns into a conversation. On j7 you don't stitch together a form service, a spreadsheet and a Zapier flow: a contact page is a first-class thing you build in the Studio in about two minutes. Here's every step, from empty to live.

Step 1 — Open your Studio

Head to your space and open the Studio — the control room for everything you publish. Click Create in the top menu bar; it's the launchpad for posts, pages, tracks and links.

Step 2 — Start a contact page

In the Create menu, choose New contact page. Instead of a blank canvas, j7 drops you straight into a layout that already has a working contact form wired up.

Step 3 — Pick a starter template

Choose a starter you like and hit Use this. Templates are just a head start — every block, colour and word is yours to edit afterwards, so don't overthink the pick.

Step 4 — Make it a page

Give it a title, then leave the Category field empty. That one detail turns your post into a page: it lives at a clean /contact URL and stays out of your blog feed. j7 spells this out right under the field.

Step 5 — Set your form fields

Open the form block and shape it to what you actually want to collect. Each row is one field a visitor fills in — add, rename, reorder or remove. Name, email and a message is a great default.

Step 6 — Flip it live

When it looks right, tick Visible to everyone and save. That's the publish switch — your page is now public. Hit View live to open it in a new tab.

Step 7 — Your page is live

That's a real, fast-loading contact page at your-space.j7.is/contact — no build step, no deploy, no form service. Share the link anywhere.

Step 8 — Replies land in your inbox

Every time someone submits the form, it shows up in your inbox — name, email and message, right inside the Studio. No spreadsheet, no third-party form tool to wire up and babysit.

That's the whole thing

Eight steps, about two minutes, zero code — and the page is genuinely fast because j7 serves it from cache, not a builder runtime. The contact page in these screenshots is the same kind you'd build on dev3lop.j7.is; the form below is one too, so if you spin one up and hit a snag, that's a fine place to tell us.

Getting a real, fast, measurable website live on j7 takes about 1 minute. Here's the whole journey — welcome, sign-in, studio, writing, publishing, and measuring — with a screenshot of every step.

1. Start at the welcome screen

Go to j7.is and you'll land on the welcome screen. There's exactly one thing to do here: begin your space.

2. Sign in with GitHub

j7 signs you in with GitHub, so there's no new password to create or remember. Click Login, authorize j7, and you're in — that's the entire account step.

3. Land in your Studio

Once you're in, the Studio is your home base. Set a profile image, add social links, manage your subdomains and short links, and see every post in one place. The buttons up top jump you to your public space, your other mysp4ces, or a brand-new post.

4. Write your first post

Hit + New post and you're in the editor. You build the page out of blocks — headings, paragraphs, images, callouts, call-to-action forms, and more — set a category, slug, and cover image, and you can even invite a co-editor to write alongside you in real time.

5. Publish — and it's instantly live

Press publish and your post goes live at your own subdomain, served as cached, SEO-clean HTML. This is what a finished post looks like to the world: cover image, title, byline, and your words.

6. See exactly how people read it

Every post comes with analytics built in — views, unique visitors, read-through, dwell time, referrers, and devices — plus an A/B test and a conversion ranking. No extra scripts, no extra tools, no bolt-ons.

And the part most platforms don't give you at all: a privacy-respecting cursor heatmap that replays attention over a faithful, full-page render of your post — cover image, headline, and all — so you can see precisely where eyes and cursors go.

That's it — you're publishing

Welcome → sign in → write → publish → measure. Speed, SEO, white-labeling, testing, and analytics are already on; you just use them. Claim your subdomain and start your space.

We think j7.is is all the different pieces, put together. Not really a wordpress. Not really a CRM. j7 is the fastest way to put something you've written — a blog, a landing page, a launch of a new idea, an entire funnel — on the internet under your own name, and then actually understand how people read it. In this post, we will create the "you.js.is" vanity domain today. Using this app, you get a space at you.j7.is, a live block editor, and a stack of tools that normally mean five separate subscriptions: A/B testing, cursor heatmaps, lead capture, short links, and analytics that don't sell out your readers. This post is the long version of what all of that means.

A space that's actually yours

Every j7 tenant gets a subdomain — you.j7.is — and it is entirely yours. Posts live at you.j7.is/<category>/<slug>, standalone pages live at the bare you.j7.is/<slug>, and there's a public profile, a reactions board, and /fire and /funny feeds ranked by what readers actually loved. It looks like a tiny, fast website because that is exactly what it is.

One account can run many mysp4ces. Switch between them from a single place, point custom subdomains at any of them, and collect every lead from every space in one shared inbox. Run a personal blog, a product site, and three campaign landing pages without juggling logins.

Writing: a block editor that stays out of the way

You build pages from blocks — headings, paragraphs, quotes, callouts, code, images, galleries, embeds, and dividers — plus a few that do real work: call-to-action forms that capture leads, navigation bars that link back to your own brand, and inline music pulled from your space's playlist. No HTML, no theme wrestling, no plugin zoo.

Editing is live and collaborative. Invite a co-editor and you'll see their cursor and presence in real time, the way you'd expect from a modern doc tool — except the output is a real, cacheable, SEO-clean web page.

Brutally fast, on purpose, stream your thoughts

Speed isn't a setting in j7; it's the architecture. Finished pages are cached as ready-to-send HTML, with a three-tier store behind them: Redis holds what readers see, SQLite is the source of truth, and Neon is cold storage. A typical read never touches a database at all. When you publish, the cache is invalidated immediately — so readers get freshness without ever paying the render cost.

White-label: make it yours, not ours

Any page can shed j7's chrome. Turn off the global navigation, the footer music banner, the Lobby chat, the date, the author byline, even the reactions bar — each is a single toggle. Drop in your own navigation block linking back to your platform, and the page reads as a native part of your brand. The one thing that always stays is a small footer credit — that's the deal for free, fast hosting.

Pages and posts are the same thing wearing different clothes. Give something a category and it's a post — listed in your feed, ranked, reaction-enabled. Leave the category empty and it's a page — a clean, standalone URL that's perfect for a landing page or funnel, kept out of the feed but still in your sitemap.

A/B/C testing, built in

Every post and page can run a split test with up to three arms (A, B, C). Pick what "winning" means — engagement, reaching the end, CTA clicks, or leads captured — and j7 ranks the arms for you, with a confidence read on whether the signal is real yet. Flip on autopilot and it serves the confident winner to everyone automatically.

The clever part: splitting is cache-safe. Every arm is baked into the cached HTML and a tiny script picks each visitor's arm on the client — stickily, so they always see the same one. You get real experimentation without giving up the speed of a static cache, and without the flicker most A/B tools cause.

Cursor heatmaps that respect your readers

j7 records where attention goes as an aggregate cursor heatmap — density only, never individual trails, never anything personal. It honors Do-Not-Track and Global Privacy Control, and your own visits aren't counted. Heat is captured per screen-size bucket — phone, tablet, desktop, and wide — so you see how each device size actually experienced the page, and you can replay it per A/B arm and per version over a faithful, full-page render of the post: cover image, headline, byline, and all.

Analytics without the creep

Alongside the heat you get the numbers that matter: views and unique visitors, reads and read-through rate, average dwell time, scroll depth, top referrers, countries, devices, and browsers — plus leads and conversion rate when you're capturing them. Enough to make a real decision, with none of the third-party tracking-script sprawl.

Capture leads, track every link

Add a CTA form to any page and submissions land in your unified inbox — one place across all your mysp4ces. Need to share a page in ten places and know which one worked? j7's short links are tracked redirects with a QR code for each, click-counted per platform, and managed both per-post and across your whole studio. Stop guessing which channel drove the traffic.

The social layer (use it or hide it)

If you want them: reactions (up, down, fire, funny), global /fire and /funny boards that rank the best posts across j7, a leaderboard, a per-space music player whose footer banner keeps playing as readers move between pages, and a Lobby chat widget. If you don't, every one of these is a single toggle away from gone.

SEO you can't forget

Meta tags, Open Graph, JSON-LD structured data, and a sitemap are synthesized centrally for every page — so they're correct by default and you can't accidentally ship a page without them. Fast, semantic HTML plus clean metadata is exactly what search engines reward.

Under the hood (for the curious)

j7 is an Astro server-rendered frontend with small React islands, backed by a lightweight Hono content API running on node:sqlite, with Redis for the hot cache and live collaboration. The frontend deploys on Netlify; the backend runs in Docker on a single small DigitalOcean droplet behind Caddy. It's a tidy monorepo, built and run by dev3lopcom, llc.

you.j7.is/                  -> your profile + recent posts
you.j7.is/<category>        -> a category feed
you.j7.is/<category>/<slug> -> a post
you.j7.is/<slug>            -> a standalone page (no category)
you.j7.is/fire              -> top posts, ranked by reactions
you.j7.is/studio            -> your private dashboard

Who it's for

Writers who want a fast home that's theirs. Founders who need a landing page and a funnel by this afternoon. Marketers who want to A/B test and read a heatmap without bolting on four scripts. Anyone tired of paying for — and stitching together — a CMS, an A/B tool, a heatmap tool, a link shortener, and an analytics suite, when one fast thing can do all of it.

Own your words, your domain, and your data — and still ship in minutes.

— dev3lop

Getting started

Claim a subdomain, open the editor, write, publish, iterate, analyze analytics, and move on your ideas in on single unified application. Speed, SEO, testing, and analytics are already perfected. The whole point is that the boring parts are handled, so you can spend your time on the important parts of the grind.