Bookmark Directory / Navigation Site (Self-Hosted Edition)

Engineering & Development

Turns your bookmarks into a self-hosted directory or navigation site: compose brings up two containers, the app and PostgreSQL, the home page comes preloaded with a set of demo bookmarks, and once you log in to the admin area you can import your own bookmark JSON; a quick-start and a troubleshooting guide in Traditional Chinese are included. A derivative build on top of an MIT-licensed open-source project.

Subscribe & download See how to start

SubscriptionUS$49 per month

Last run2026-11-02

In practice

Readiness4 / 5

What you need

Few changes needed5 / 5

Who it is for

People who want to run their own directory, navigation or listing site: a personal tool navigation page, an internal team bookmark portal, a vertical resource directory. The selling point is the self-hosted experience of "unzip, two commands, open a browser": collections, folders and the card view are managed in the admin area, and the data runs in a PostgreSQL container on the buyer's own machine. This product is a delivery snapshot the buyer hosts themselves; we do not offer cloud hosting.

How to start

$ ./scripts/init-env.sh
$ docker compose up -d --build

Browse the files

Files in the product repository at the pinned commit. A few house files are left out of the zip.

File overview176 paths

▸prisma1

schema.prisma

▸public30

assets/
default-images/
favicon/
file.svg
globe.svg
logo.png
logo.svg
og-image.png

▸scripts3

entrypoint.sh
init-env.sh
seed.cjs

▸src119

actions/
app/
components/
hooks/
lib/
middleware.ts

▫ATTRIBUTION.md

▫Dockerfile

▫LICENSE

▫LICENSE-99LL

▫PRODUCT.md

▫QUICKSTART.md

▫README-zh.md

▫README.md

▫SECURITY.md

▫components.json

▫delivery-manifest.txt

▫docker-compose.yml

▫generate-hash.ts

▫next.config.js

▫package-lock.json

▫package.json

▫pnpm-lock.yaml

▫postcss.config.mjs

▫tailwind.config.ts

▫tsconfig.json

▫vercel.json

▫Config and hidden files 2

Latest passing run

Clone → Checkout → Toolchain → Init env → Build → Up and see → Teardown

Pre-purchase Disclosure

What you are buying

A bookmark directory site: collections, folders, a card view and search, with a set of demo bookmarks preloaded on the home page; plus an admin area with interfaces for managing collections and folders and for importing bookmarks.

A derivative build on top of an MIT-licensed open-source bookmark navigation project; the containerisation, the initialisation script, the demo seed, the login guards on six API routes and the Traditional Chinese documentation are ours. Delivery is a frozen snapshot: one zip file, taken from the product repository at revision b8533ae.

Known limitations

compose brings up only the app and PostgreSQL, exposed as HTTP on port 3000; TLS and a reverse proxy are yours to provide
The admin area’s default account is [email protected], with the password produced by scripts/init-env.sh
The database data lives in the pgdata volume, and docker compose down -v deletes it
The app service has no volume mounted, so logos and favicons uploaded in the admin area disappear when the container is rebuilt
The first start builds the image from source, fetching the base image and npm packages over the network
The site icons for the demo bookmarks are served by favicon.im, so opening the home page makes the browser connect to that service
Pinned to the delivered snapshot; it does not follow upstream.

The liability cap, the scope of what is promised and the statutory floor are governed by the Terms of Service.

Vetting record

Everything below was checked against the pinned commit 91023a3. Every verdict carries its full reasoning, an evidence link and the checker; failures are published, not hidden — do not take our word for it, verify it yourself.

4 PASS1 WARN0 FAIL

Source ReviewPASS

A full-source scan plus a route-by-route review of the API: grep for child_process / eval / new Function returns zero hits in src/. Server side: /api/url-info fetches the title and icon of a user-supplied URL as the server (an SSRF surface, now behind a login guard), one of its icon fallbacks is logo.clearbit.com, and init-settings fetches a default image from its own baseUrl; browser side: the demo seed points bookmark icons at favicon.im, so the home page connects to it on load, and there are two blocks of code for Google Analytics and Microsoft Clarity that only load when the matching IDs are filled in the admin settings (the default seed leaves them blank, so by default they do not load). Reviewing auth coverage route by route found six routes with no authentication (data could be injected, settings written and non-public bookmarks read without logging in); getServerSession guards have been added to those six in the product repository, and the health check verified for real that the import route returns 401 when not logged in.

Script SafetyPASS

The executable scripts inside the delivery tree are the three we added (scripts/init-env.sh, entrypoint.sh, seed.cjs), all reviewed line by line: init-env.sh only uses openssl to produce random values and write out the .env; entrypoint.sh validates the environment variables, runs prisma db push and the seed, then starts Next.js; seed.cjs only writes to the database. None of the three contains a curl or wget style download command. The only lifecycle hook in package.json is postinstall = prisma generate (which produces the DB client). Upstream's generate-hash.ts is a deprecated development tool: it does not go into the image and the entrypoint never calls it.

RecencyWARN

At the time of vetting, gh api was used to check when upstream last pushed, and by the vetting date more than a year and a half had gone by, so activity is flagged as uncertain, without dressing it up. Under the frozen-snapshot model the product does not follow upstream, and its usability is guarded by our periodic health check; the risk that upstream no longer fixes security problems is reflected in the durability assessment.

LicensePASS

SPDX:LicenseRef-99LL-Product

Two layers of licence, both inside the delivery tree: (1) upstream Pintree-io/pintree is MIT — gh api repos/Pintree-io/pintree returns license.spdx_id=MIT, and the LICENSE at the repository root is word for word the full MIT License text (Copyright (c) 2024 Pintree.io), permitting commercial use, modification, redistribution and sublicensing, with the obligation to keep the copyright and licence notices; upstream's LICENSE is kept verbatim at the root of the delivery tree, not a word changed. (2) Under the 99LL product licence template v1 we produce LICENSE-99LL as the sale and liability terms for the product as a whole (for a derivative of an open-source upstream, the template is additional terms and does not override upstream's licence), and spdx is expressed as LicenseRef-99LL-Product.

Dependency LicensesPASS

license-checker --production was run once for real inside /app in the delivered image: the licences of the direct production dependencies are only the three permissive ones MIT, Apache-2.0 and ISC; there is also one UNLICENSED entry, which is the root package itself (package.json has no licence field, and the licence is governed by the MIT LICENSE file at the repository root — it is not a third-party component). The same run then scanned the whole pnpm store (including dev and transitive dependencies): GPL and AGPL did not appear, and the two copyleft entries it found were @img/sharp-libvips (LGPL-3.0-or-later, the precompiled libvips binary for sharp, fetched from npm when the buyer runs docker build and not delivered with the zip) and axe-core (MPL-2.0, a dev dependency that does not go into the image). The delivery tree is a source tree, and it contains no node_modules path.