Built by 
About this software
About ShowingBook
ShowingBook is a CRM and viewing calendar for independent real estate agents, built as a vanilla-JavaScript PWA served by a Node 22 Express API with SQLite storage. Agents sign in and manage leads, showings, listings and follow-up tasks, with every record scoped to its owner. Confirmation and reminder messages open the phone's SMS or email app pre-filled; nothing is sent automatically, so no SMS provider is needed. An admin role manages team accounts. Capacitor 7 configuration is included for Android/iOS, but the native android/ and ios/ folders are not shipped and must be generated. The builder's description mentions localStorage with no backend, but the code shows a server-backed SQLite design.
Why ShowingBook
What makes it better
than the alternatives
- 01
Owner-scoped data
Every table carries owner_id and all reads, updates and deletes filter on it, with API tests covering isolation between users.
- 02
No SMS or email provider needed
Confirmation and reminder messages open the device's SMS or email app with text filled in, so there are no API keys or per-message costs.
- 03
Drag-and-drop workflow
Reschedule viewings on a week calendar and move listing cards between statuses.
- 04
Security basics in place
Bcrypt hashes, JWT with fresh user lookup per request, login rate limiting, Helmet CSP, parameterised SQL and http(s)-only stored links.
- 05
Simple self-hosting
Dockerfile, docker-compose with a persistent volume, health check, first-admin bootstrap via environment variables, and a 15-test node:test suite.
Viewing Calendar
- Week view with drag-and-drop rescheduling
- Click an empty slot to book
- Overlap warning
- Viewing status: scheduled
- done
- cancelled
- Duration 15-240 minutes
- notes
- confirmed and reminded flags
Leads
- Five-stage board: Lead
- Searching
- Viewing
- Offer
- Closed
- Interest tags (up to 20 per lead)
- Budget and notes fields
- Call
- WhatsApp and social links (Facebook
- other)
Messaging
- Confirmation and reminder messages via SMS or email links
- Opens the phone's app with text pre-filled; nothing sent automatically
Listings Pipeline
- Statuses: Coming soon
- Active
- Under offer
- Sold
- Drag a card to change status
- Address and price per listing
Follow-up Tasks
- Due dates with overdue highlighting
- Tasks linked to leads
- Done toggle
Reports
- Leads by stage
- Viewings this month and show rate
- Listings by status
- Top interest tags
Accounts and Team
- Admin and agent roles
- Sign-in and change password (minimum 10 characters)
- Admin Team screen to create
- edit and delete users and reset passwords
- Protections: cannot delete yourself or demote the last admin
Platform and Deployment
- Installable PWA with light and dark theme and a service worker
- Capacitor 7 config for Android/iOS (native projects generated by the buyer)
- REST API documented in
docs/API.md - Docker and VPS setup guide
- Optional CORS allow-list for native apps
| Language | Version | Framework | Used for | Share of code |
|---|---|---|---|---|
| JavaScript | — | — | Front-end | 70.5% |
| HTML | — | — | Front-end | 12.1% |
| CSS | — | — | Styling | 11.2% |
| SQL | — | — | Database | 6.2% |
- Primary language
- JavaScript (Node.js 22.13+, ES modules in the browser)
- Framework
- Express 4 (API); front end is vanilla JS with no framework
- Database
- SQLite via Node built-in node:sqlite (requires Node 22.13+)
- Authentication
- JWT Bearer tokens (HS256) with bcrypt password hashes; admin and agent roles
- Licence
- Single-site
- Screens
- 7
- Database tables
- 6
- Supported languages
- English only; no translation files in the digest; no RTL support
- Browser support
- Modern browsers with ES module support (no browser test matrix in the digest)
| Minimum | Recommended | |
|---|---|---|
| CPU | 1 vCPU | 2 vCPU |
| RAM | 1 GB RAM | 2 GB RAM |
| OS | Linux with Node.js 22.13+ (Docker base image node:22-bookworm-slim) | Linux with Node.js 22.13+ (Docker base image node:22-bookworm-slim) |
| Est. monthly hosting | $6 | $6 |
```bash cp .env.example .env # edit .env: set JWT_SECRET, and ADMIN_EMAIL / ADMIN_PASSWORD for the first admin docker compose up -d --build ``` Data is kept in the `showingbook-data` volume. The app listens on port 3000.
```bash cp .env.example .env # edit .env: set NODE_ENV=production, JWT_SECRET, ADMIN_EMAIL, ADMIN_PASSWORD cd Project npm ci npm run db:init npm start ``` Put a reverse proxy with TLS in front of port 3000 and set TRUST_PROXY=1. `npm run db:reset` wipes data and loads demo accounts, so use it only for development.
Quality report
Manually reviewedHow to read the quality report
What this is. Every project on Vibe96 goes through an automated audit of its source code before a reviewer in Dubai checks it by hand. The score is out of 100; 75 is the minimum to be listed, and any single failing check blocks a listing regardless of the score.
- Security
- No real credentials in the code, every data-changing route protected, admin areas role-gated, no SQL built from user input.
- Code structure
- A developer can navigate and extend it: clear module boundaries, no giant files, little copy-paste.
- Docs & completeness
- The setup guide, example config, schema and required files the builder committed to are actually in the archive.
- Dependency health
- Packages pinned, no known critical vulnerabilities, no abandoned libraries in production paths.
- Build & deploy
- A clean machine can restore, build and start it by following the shipped instructions.
Warnings are problems that didn't block the listing; they stay visible here until a later version clears them. The audit reads the code — it does not run it — so always try the live demo before you buy. Lines of code are counted from the same audited archive.
Reviewer notes (3 minor)
No real credentials found; shared demo password and demo seeding are weak-default risks; build mostly reproducible; setup doc not visible and a few config/path gaps; sql is parameterised and owner-scoped; schema files and some deletes/indexes could not be verified. None of these stop the software from working; the developer has been told and improvements come in a future update.
Versions & updates
No updates yet. New versions appear here with a changelog.
Buyers receive updates free for 1 year.
What you get
- </>Full source codeThe complete audited source, delivered as a download from your account. No obfuscation.
- ▤DocumentationSetup guide, architecture notes, CLAUDE.md and AGENTS.md.
- ↻One year of updatesEvery new version the builder publishes, free for 12 months.
- ♧30 days of supportInstallation and defect support through Vibe96 tickets.
