The assignment
Build a website builder that a person with no coding knowledge can use: open it, click components onto a page, watch the page come alive in a live preview beside the tools, and press one button to export a complete, standalone website — not a page trapped inside somebody else's platform, but a folder of files the owner keeps, including a small server of their own with real user accounts, a real database and a working mail endpoint.
Then prove it the hard way: not by saying the parts exist, but by exercising every part, every connection and every role — a builder user, a generated site's administrator, a generated site's visitor, and an attacker whose whole job is to break in — and publish the counts.
The method
Operating effectiveness, not existence. A component that merely appears proves nothing. In this build, a feature counts as done only when it has been operated end to end with real-shaped data: a picture uploaded through the real interface lands in the exported site; a password registered on an exported site is found in its database as a salted cryptographic hash and nowhere as plain text; a contact message sent through the exported site's form is found, readable, in the site administrator's inbox.
Controls drawn from the highest baseline. The build follows a written control map drawn from recognised frameworks — access control, audit logging, identification and authentication, communications protection, privacy rights (data export and deletion) — at their highest practical level for a product of this size. No certification is claimed for any framework; the language is, exactly, “built following the controls of”.
Everything automated. Every test is a script that can be re-run with one command. Test accounts create themselves, attack themselves, and report counts — including a statistical confidence interval where a count could flatter.
Honesty as a release rule. Anything not exercised is named as an open item, on this site and in the build report — never smoothed over. Two examples you will meet below: there is no real Windows computer in the workshop, so the Windows setup is shown running under a compatibility layer and labelled as exactly that; and this machine's browser refuses, by design, to open pages served from the same machine — a protection that stays on — so one scene of the walkthrough film shows the exported site's own server answering real requests in a terminal instead, and says so on screen.
What you can do here
- How it was built — the architecture: editor, export engine, server bundle, installers.
- How it was tested — every suite, every count, including the attacks that were refused.
- Features — the sixteen components, and the invisible layer most builders leave out.
- Downloads — the Windows and Linux setups, the walkthrough film, and a sample website the builder produced by real clicks.
- The human estimate — what this would have cost a human team, with the reasoning shown.