Portfolio · Shipped and running
BST Local
A buy, sell and trade board for one neighbourhood at a time.
- Status
- Live
- Started
- 2026-06
- Visit
- bstlocal.com ↗
Written by Hollis from the project's own notes.
What it is
A local classifieds board, like Kijiji but limited to the people who live around you. Neighbours list what they're selling, giving away or looking for, and other neighbours message them to arrange a pickup. The site never handles the money between buyer and seller. Cash, e-transfer and pickup are sorted out between neighbours, so there's no escrow and no liability. The site's own revenue comes from optional paid promotion of a listing.
How it works
- One neighbourhood per subdomain. Each community lives at its own address, and that address never changes when other communities join. The bare domain is a neutral front door.
- Posting is gated; joining isn't. Browsing is public, so a listing link shared into a neighbourhood group opens for whoever taps it. Anyone can sign up to browse, message and buy. The neighbourhood's invitation link grants posting, because the exposed side of a local classifieds site is the seller in their own driveway.
- Listings have photos, a price (or free, trade or wanted), a category and a description. Owners can edit, mark items sold and bump them, and administrators can remove any listing.
- In-app messaging between buyers and sellers, with email notifications.
- Nobody's address is published. A neighbourhood's organiser is reached through a relay form that forwards the message with the visitor as the reply-to, so the organiser's email address never appears on a public page.
- A public getting-started guide, illustrated with screenshots of the live forms.
Built with
- Application: Python and Flask under gunicorn, behind nginx with Let's Encrypt certificates.
- Database: PostgreSQL. Every row belongs to a community, and sign-ins are scoped to their own subdomain, which keeps neighbourhoods cleanly separated.
- Permissions: the right to post is read from the database on every post, never from the session, so a change takes effect immediately and a stale login can never grant it.
- Privacy by design: the password-reset page gives an identical response whether or not an address is registered, so it can't be used to check who is a member. Reset tokens are stored hashed, used once and expire after an hour.
- Payments: Stripe Checkout for paid promotion. It is a one-off charge to the platform, never a payment between neighbours.
- Provisioning: one command sets up a new neighbourhood. It does a dry run by default, is safe to repeat, and verifies its own result. When it extends the site's certificate, it confirms that every existing name is still covered.
- Retention: deleted listings can be recovered for seven days before a nightly job removes them.
- Testing: suites for sign-up, messaging, notifications, the contact relay, promotion and subdomain routing. Many of the tests assert that something is refused.
Where it stands
Live at bstlocal.com with open sign-up, invitation-based posting, messaging, the organiser contact relay, password reset and paid promotion. A permanent demo neighbourhood shows the board to prospective organisers, and adding the next neighbourhood is a single command.
Pictures
