~/blamejs.shop — secure commerce · v0.5.28
Sell anything.
Trust nothing.
An open-source, server-rendered ecommerce framework with post-quantum cryptography baked into every session, cart, and checkout. No client-side validation theater. No npm runtime dependencies. Just hardened HTML.
- Products live
- 12
- npm runtime deps
- 0
- Default crypto
- PQC
- License
- Apache 2.0
Featured
Buy Me a Coffee
A five-dollar thank-you. If the framework saved you an afternoon of yak-shaving, this buys the next pot of coffee that keeps it maintained. No shipping, no shirt size — just a receipt and our thanks.
$5.00
View productBuilt on blamejs
Every behavior on this site is a composed primitive.
Twenty-plus shop primitives — cart, catalog, payment, order, subscriptions, customers, webhooks, audit log, sealed sessions, signed cursors, problem-details, money math, FSMs — sit on a vendored blamejs core that ships hundreds more. They compose. Replacing one doesn't fork the others.
Read the source on GitHub- 01
Server-rendered HTML
Every route renders a complete document at the origin. No client framework, no hydration spinner, no JavaScript required to read the page.
- 02
PQC-first crypto
ML-KEM-1024, ML-DSA-65, XChaCha20-Poly1305, SHAKE256, HKDF-SHA3-512, Argon2id. The application never reaches for AES-GCM, SHA-256, or classical ECDH on its own.
- 03
Zero runtime npm deps
One vendored framework, shipped byte-for-byte from a signed release tag. The tarball you install is the tarball that ran in CI.
- 04
Security defaults on
CSRF, fetch-metadata, origin, bot-guard, sealed cookies, Trusted Types, DoH, cookie-prefix policy — composed into the request lifecycle, not behind a feature flag.
Catalog
Products in store
Server-rendered listings — every card, price, and link arrived on the wire as complete HTML.
