jekcms 2.43 — Offline Docs, Sample Content, and a Hardening Pass

This cycle had two guiding questions. First: what does the first hour with jekcms feel like — before you have written anything, before you have read anything online? Second: what quietly protects you in month six — the encryption around your stored keys, the schema your installer shipped, the release process that decides whether a bug reaches you at all? Versions 2.42.0 through 2.43.3 answer both. Here's the tour.

The full documentation now ships inside the package

Every installation package now carries the complete documentation — all 37 guides, in both English and Turkish — as self-contained HTML under documentation/. No external assets, no CDN, readable on a laptop with no connection at all.

• The admin panel's "How to use this" links now open your local copy first, and only fall back to jekcms.com when the folder isn't there. Help keeps working even if our site is unreachable.
• The packaging step verifies the docs are present in every build — a package without them simply doesn't ship.

An empty site is no longer an empty screen

A fresh install used to greet you with a blank Posts list. Now it offers two clear paths: write your first post, or load sample content — six short, well-formatted starter articles across three categories, with generated cover images. The samples double as a formatting guide (headings, lists, quotes, images), and one click removes all of it — posts, categories and covers — without touching anything you created yourself.

A security hardening pass, end to end

Two independent code reviews went over the product this cycle, and we shipped fixes for everything they found:

• Authenticated encryption for stored secrets. Values encrypted at rest — including AI provider API keys and OAuth tokens — now use versioned AES-256-GCM, so a tampered record is detected instead of silently accepted. Existing records migrate automatically; the settings screens now show only a masked hint and never echo a stored key back into the page.
• CSRF-protected sign-out. An external page can no longer force-end an admin session with a plain link; logout is a proper POST with a token.
• Fail-closed API roles. A user record with an empty or unknown role now gets no write access, instead of inheriting admin rights through an old compatibility fallback.
• No more leaky error messages. API errors return a fixed message with a reference code; the details go to the server log, not to the client.
• Rate-limited license activation (2.42.0), closing an unthrottled path for guessing license keys.

Releases now prove themselves before they ship

The most important change of the cycle is invisible in the interface. Every release now has to pass, on a real MySQL database, a fresh-install acceptance test: the exact schema we ship is installed from scratch and the product's critical write paths run against it in strict mode. On its very first run this test caught a real one — several editorial audit columns existed on our own sites but had never made it into the installer schema. That class of bug now cannot reach a customer.

• A hardening regression suite (37 checks) locks in the security fixes above: encryption round-trips, route targets, role checks, error masking. A regression in any of them blocks the release.
• An internationalization gate does the same for language: new untranslated admin text can no longer slip into a release unnoticed.
• These gates run both locally and in the deployment pipeline — the same checks, on every push.

Smaller fixes worth knowing about

• Auto-activated plugins now create their database tables on a fresh install (2.42.0) — Newsletter no longer appears "active" with its screens broken.
• The cron runner handles overlapping runs gracefully instead of crashing, and command-line errors exit cleanly with a proper code.
• The public /login and /logout routes redirect correctly to the admin, and themes with an FAQ page got a real /faq route.
• Creating an API key on a brand-new install works again, and the social share queue no longer loses its publish timestamps on strict-mode databases.

Current version: 2.43.3. As always, updates are free and existing installations pick them up through the built-in updater.