C and CGI power a commercial web product in 2026

A commercial app on CGI in 2026

Corey Prophitt says he shipped marketyour.games as a commercial web product built with C and served through CGI. The product includes user accounts, a search dashboard for content creators, folders for organizing content, payments through Stripe and transactional email through Postmark. It follows progressive enhancement and does not require JavaScript.

The stack is BCHS: OpenBSD, C, httpd and SQLite. There is no framework, no templating language, no separate database server and no container. A C program reads CGI environment variables and responds, C code outputs HTML directly, and the SQLite C API opens the database file. Deployment is a statically linked binary dropped in a folder.

One binary and three libraries

Every request spawns a fresh process, so deploying a new version means replacing one file. Prophitt says there is no server restart and no downtime, and new requests simply pick up the new binary. OpenBSD provides defaults and tools such as pledge and unveil for securing a C program, while httpd serves from a chroot by default so the CGI binary is sandboxed.

The extra libraries are libcurl for outbound requests to Stripe and Postmark, libsodium for random identifier generation, password hashing and Stripe webhook HMAC verification, and libcjson for JSON parsing. Only libcurl and libsodium are build dependencies. libcjson is a single C file with no external dependencies, and SQLite is used through its official amalgamation. Both are vendored and built with the project.

Prophitt routes all httpd traffic to the CGI binary and compiles assets into the executable so they are served from memory. He describes a clean build as taking a few seconds and rebuilds as taking less than half a second. His supply chain is a C compiler and three libraries, with Vim and zero plugins as the main editor.

What would change

CGI gives very little out of the box, so utilities for cookie parsing and creation, query parameter parsing and validation, form data parsing and validation, and input escaping still need to be written. Prophitt rolled his own in a single header file, cgi.h, but is not convinced that was the right solution. He notes that libraries such as kcgi exist, while adoption means accepting their API and security model, and he would like shared utilities in the style of the stb libraries.

His conclusion is that CGI is old but not forgotten. Process forking is less expensive than it once was, and FastCGI is a possible upgrade if forking ever became a problem. The product runs on a single binary using a serving model standardized in 2004, with fewer moving parts than anything he has shipped before.

Sources: prophitt.me