PostgreSQL. PHP 8.x. REST API. Plugin system. Theme engine. Readable code, no lock-in.
A clean, well-structured PHP application. No framework magic — just patterns that work.
PostgreSQL with PDO prepared statements everywhere. Active Record pattern for data models. Version-controlled migrations.
PHP 8.x, MVC-like architecture. Front-controller routing. Clean separation of data, logic, and views.
Zero-dependency HTML5 by default. Modern vanilla JavaScript. Bootstrap and Tailwind support also available.
Full REST API with key-based authentication, rate limiting, CORS support. 40+ model endpoints with CRUD + actions.
Self-contained modules with their own data models, views, admin pages, routes, and scheduled tasks.
Override chain — theme → plugin → base. Customize anything without forking. Component system for reusable sections.
Membership platforms hold sensitive data — names, emails, payment info, personal details. Security is not a feature here. It is the baseline.
Every database query uses PDO prepared statements. There are no exceptions and no raw string concatenation paths. This is enforced structurally, not by convention.
All user-generated output is escaped with htmlspecialchars. The FormWriter system handles output encoding automatically so individual views cannot forget.
Session-based authentication with role-based access control. Permission checks happen at the controller level before any data is loaded or rendered.
CSRF token generation is built into the FormWriter. Available on every form out of the box — no extra setup required.
Passwords are hashed with Argon2id — the current best practice. Legacy bcrypt hashes are automatically upgraded on next login. No plaintext, no MD5, no SHA.
All cookies are set with HttpOnly, SameSite=Lax, and Secure flags. Session cookies are not accessible to JavaScript and are scoped to prevent cross-site request attacks.
You can read every line of code that touches your members' data. No obfuscation, no compiled binaries, no trust-us black boxes.
File uploads are validated by type and size, stored outside the web root where possible, and served through controlled handlers — not direct URLs.
Every feature is accessible through the API. Build integrations, automate workflows, or build your own frontend.
Plugins are self-contained modules that can add data models, views, admin pages, API endpoints, and scheduled tasks. Each plugin has its own MVC structure.
Themes control the entire visual presentation. The override chain lets you customize any view, template, or asset without modifying core files.
Run Joinery on your own infrastructure. Same software, complete control.
PHP 8.x, PostgreSQL, Apache or Nginx. Standard LAMP/LEMP stack — nothing exotic.
Clone the repo, run the installer, configure your database. Docker supported. Or let us do it with White Glove Install ($249).
Automated upgrade system. Run one command to pull the latest version and apply migrations.
Joinery is source-available under the PolyForm Noncommercial license. Read the code, file issues, or contribute.