Corey Prophitt built marketyour.games — a commercial web product with user accounts, Stripe payments, search dashboards, folders, and transactional emails — entirely in C, served via CGI on OpenBSD. The stack is BCHS: OpenBSD, C, httpd, and SQLite. No framework, no templating language, no container, no JavaScript required. Every request spawns a fresh process. Deploying means replacing one file. The dependency story is the quiet headline here. Three libraries: libcurl for outbound HTTP to Stripe and Postmark, libsodium for crypto (password hashing, HMAC verification, random IDs), and libcjson for JSON parsing. Two of those are actual build dependencies; the other two (libcjson and SQLite's amalgamation) are single C files vendored into the project. A clean build takes seconds; rebuilds finish in under half a second. Static assets are compiled into the executable and served from memory. Prophitt's case against the conventional wisdom is specific: the performance objection to CGI — process forking is expensive — was valid in 2004 but modern kernels optimize fork heavily. The security objection dissolves on OpenBSD, where pledge and unveil constrain the binary's syscalls and filesystem access, and httpd runs CGI from a chroot by default. The productivity objection — writing HTML in C sounds miserable — turns out to be less painful than fighting editor plugins to correctly highlight Go templates or Jinja inside Rust. The SQLite choice deserves its own mention. No server process, no configuration, no upgrade treadmill. Your application opens the database file directly through SQLite's C API. For a product at this scale, the operational simplicity is real. Postgres is great, but it's a dependency with a heartbeat you have to monitor. The honest gaps are worth noting. CGI gives you nothing out of the box — no cookie parsing, no query parameter validation, no form handling, no input escaping. Prophitt rolled his own utilities in a single header file (cgi.h) and isn't fully convinced that was the right call. Libraries like kcgi exist but mean buying into someone else's API and security model. He'd like to see stb-style drop-in utilities for this space and may publish his own. The supply chain argument is the one that lands hardest in 2026. Most modern stacks pull hundreds of transitive dependencies maintained by strangers with reused passwords. Prophitt's attack surface is a C compiler and three well-watched libraries. With autonomous agents probing package repositories weekly, the minimalism isn't aesthetic — it's operational security. This is a practitioner's report from production, not a proof-of-concept blog post. The product is live, commercial, and handles real money. The argument isn't that everyone should write C web apps. It's that the reasons we stopped doing it have quietly expired, and the tradeoffs look different when you value comprehensibility and minimal moving parts over ecosystem convenience.
