// the find
adityabhalsod/headless-cms
Self-hosted headless CMS with a hand-written C11 backend (zero framework, custom ORM, multi-DB) and a React 19 + TypeScript admin panel - model content types at runtime, backed by Postgres, MySQL, or SQLite.
A self-hosted headless CMS with a hand-written C11 backend (own HTTP router, ORM, JWT/RBAC, migrations) instead of a framework, plus a React 19 admin panel. It's aimed at developers who want to see a CMS built from bare metal in C, or who specifically need to avoid a Node/framework runtime on the server — not at anyone who needs a production-ready Strapi alternative today.
The ORM genuinely abstracts three databases behind one dialect-aware query builder with a Django-style migration system (makemigrations/migrate/rollback/squash), which is a lot more than most 'from scratch' ORMs bother with. Backend tests are real HTTP integration tests run against a live server across all three DB engines, not mocked — that's the right call for a hand-rolled data layer. The setup.js tooling wraps ASan/UBSan/TSan/valgrind/strace/perf out of the box, which shows the author is treating memory safety and concurrency bugs as first-class concerns rather than something to discover in prod.
1 star, 1 fork, no CI badge or release tags — this is a brand-new solo project with no signal that the test suite is actually green in practice. The README itself is internally inconsistent about the core feature: it says creating a content type provisions a real `ct_<slug>` table, but then says entries actually live in a generic `contents` table with a JSON `data` column — those are two different storage models and it's unclear which one is true. Rolling your own JWT, password hashing glue, HTTP router, and query builder in C is a large attack surface for a CMS that handles file uploads and multi-tenant content, and the security section leans heavily on 'we used libsodium/parameterized queries' without addressing memory-safety class bugs in the custom router/ORM itself. There's also dead code already in the tree (content_export.c, search.c) excluded from the Makefile — a sign the scope grew faster than what's actually wired up and tested.