LMS

The problem

Most course platforms still model a lesson as one plain-text field rendered as a truncated string, let any edit to a live course change what students see mid-typo, and treat "file upload" as a URL text box with nowhere for a student to keep a private note.

The product

This LMS is a modular-monolith built around three commitments: a real WYSIWYG block editor for authoring, a hard separation between a course's draft and its published state, and tenant isolation enforced at the storage layer, not just in the UI.

Available today

Built and tested, verified directly against the source — not just the product's own documentation:

A genuine BlockNote editor integration — native drag-drop blocks, a "/" slash menu, one-second-debounce autosave, and custom upload/resolve handlers wired to the app's own media API.
Real draft/publish separation — a lesson holds both a draft and a live content body, promoted only on explicit instructor action, with a dedicated automated test proving an enrolled student's view doesn't change mid-edit.
Tenant-isolated media storage — uploads use a server-minted, opaque storage key that can never be derived from user input, and an extension allowlist (roughly 20 types) rather than a denylist, an explicitly OWASP-informed design choice in the code itself.
Real drag-drop reordering and course cloning — a genuine deep copy of a course, its sections, and its lessons, resetting the clone to draft status under a new instructor.
A new, real engagement module for private per-lesson student notes (with optional video/audio timestamp anchoring) and bookmarks.
Hardened multi-tenant security — middleware that refuses to let a client-supplied tenant header override a JWT's tenant claim unless the caller is a platform admin, with its own dedicated regression test covering exactly that attack path.

Upcoming features

Honestly scoped as not yet built, per the project's own go-live tracking:

Cloud object storage for media — the storage layer is tenant-isolated today but backed by local disk, not a cloud provider, behind an interface designed to make that swap straightforward.
PDF certificate generation (HTML certificates work today), payments, and SCORM/LTI interoperability.
SSO and a password-reset flow.
Moving session tokens from browser storage to httpOnly cookies.
Enforcing the course-approval workflow that's currently modeled in the data but not yet gated in the UI.

Who it's for

Training providers and corporate L&D teams needing safe live-course editing.
Cohort-based course creators wanting a real editor, not a plain-text box.
Education platforms evaluating a multi-tenant LMS core to build on.

Platform and stage