Documentation · Architecture · Apache 2.0

A WSGI server that keeps the blast radius of a security bug small. Each route runs in its own process under its own Unix user, talks to a local proxy instead of the real database, and may run only the SQL its manifest grants it — so one exploitable bug in the least important page is worth that page, not the app. Linux only, CPython 3.13+, PostgreSQL.

Get started

uv add adds to a project, so uv init one first; with pip, skip both. In a container, run blastit as root directly rather than through sudo.

$ uv init && uv add blastit       # or: pip install blastit

def application(environ, start_response):
    start_response("200 OK", [("Content-Type", "text/plain")])
    return [b"hello from blastit\n"]

version = 1
[[route]]
name = "hello"
path = ['.*']

$ sudo env BLASTIT_APP=hello:application BLASTIT_MANIFEST=$PWD/blastit.toml \
           PORT=8080 .venv/bin/blastit

Read the documentation → framework guide · infra guide · reference

License

Apache 2.0 — see LICENSE.