Fast Kanban — A Zero-Signup Kanban for Project Roadmaps

Problem: kanban tools are built for teams. I wanted a roadmap board I could create and share in seconds.

Stack: Vue 3, Hono, Prisma + MySQL, Bun in development and Node in production, GitHub Actions to a CloudPanel VPS.

Key decision: no user accounts at all. Anyone with the link can read; a one-time edit key protects writes.

Outcome: live, and it hosts the roadmaps of my other projects, including its own.

The problem

I keep several projects moving at once and each needs a roadmap: what’s next, what’s in progress, what’s done. Trello, Jira and Linear come with accounts, workspaces, permissions and billing. I wanted a sheet of paper with columns that happens to live on the internet.

A board should behave like a URL: you create it, you share it, and it works.

Fast Kanban home: a “Create a board” form with board title, card prefix and a toggle to continue numbering from another project The whole onboarding: a title and a prefix. No account, no email.

Constraints

Zero signup, for the creator and for everyone viewing.
Readable by link alone, with writes still protected.
Cheap and self-hosted: one VPS with MySQL.

Key decisions

1. Protect writes without knowing who the user is

Problem. Writes need protection, but “who is this user?” is exactly the question the product refuses to ask.

Options. Accounts and magic links both need identity. A secret edit URL leaks through browser history and screenshots.

Decision.

Creating a board returns a public link and a one-time edit key, shown once.
Reading needs nothing. Every write sends the key in a request header.
The server stores only a salted scrypt hash and compares in constant time.

Why it holds. One decision removes signup, login, password reset, sessions and user management from the whole product.

The Fast Kanban roadmap board in read-only mode, with “Enter edit key” as the only way to write What a visitor sees: the full board, marked Read-only.

2. One codebase, two runtimes

Problem. Bun is great for local development, but production runs on plain Node.

Decision. A hard rule: no Bun-only APIs on the server. Node’s built-in crypto replaces Bun’s password helpers, and the Prisma client stays out of the bundle because of its native bindings.

Why it holds. The same code runs in both places with no forks. One process serves both the API and the built frontend.

3. Card IDs people can say out loud

Problem. #482913 means nothing in a commit message.

Decision. Each board has a prefix (FAK, ZWK) and a counter, incremented inside a transaction, so two cards created at the same time can never get the same number.

Why it holds. It became the most-used feature. Commits in my other projects reference cards directly, like [FAK-16] Prevent clickout when edit a card.

4. Treat every card as untrusted

Problem. Card bodies are free-form Markdown on a page anyone can open, which is a stored-XSS risk.

Decision. Render with markdown-it, then sanitize with DOMPurify, every time.

Hard problems solved

A lost key means a read-only board. A verify endpoint lets the interface tell “wrong key” apart from “no key”, so the failure is clear instead of mysterious.
Keeping it portable. Cross-runtime support is easy to lose quietly, so the rule was enforced from the first commit.
Choosing libraries case by case. Zweek uses native drag-and-drop; here, vuedraggable was worth it for reordering columns in a modal.

Trade-offs

No accounts, no recovery: right for roadmaps, wrong for anything that needs ownership.
Open to read by design: sensitive data doesn’t belong on a board, and that line is deliberate.
Self-hosted: near-zero cost, but I own backups and uptime.

The Zweek roadmap board on Fast Kanban, with ZWK-numbered cards across Todo, Doing, Review and Done The Zweek roadmap: every ZWK commit in that project points to a card here.

Result

Fast Kanban is live at fast-kanban.zwinglio.com and in daily use. It hosts the Zweek roadmap and its own, the board behind every FAK commit.