F#CK AI SLOP.

Hacked on launch day? Imploded on the third user? Woke up to a $4,000 API bill?

Get proper infrastructure already. And make money.

Get the code See the scores →
304
Unit tests
23
E2E tests
9
CI gates
1
Deployed service
3
Accounts to open

01 / problem

Stop dying on every hill.

Every boilerplate looks great on day one. Then reality hits you.

average boilerplate
postmortem.log
$ my-project postmortem.log
my-project · 18 weeks since launch
week 1✓product shipped
week 3×service key readable in the client bundle
week 4×leaked key abused overnight. $1,847 billed
week 6×private data leak. 3 users threaten legal action
week 7×retried webhook charges 40 users twice
week 9×refunds and chargebacks pile up
week 11×requests time out under slightest load. no trace.
week 14×churn doubles. so do the 1-star reviews
week 18×you are drowning instead of scaling the product
8 incidents, 0 caught before users
$ my-project postmortem.log
my-project · 18 weeks since launch
week 1✓product shipped
week 3×API key readable in client bundle
week 4×leaked key abused. $1,847 billed
week 6×private user data leak.
week 7×retry charges 40 users twice
week 9×3 users threaten legal action
week 11×requests time out under any load
week 14×churn and 1-star reviews double
week 18×you are drowning in problems
8 incidents, 0 caught before users
this boilerplate
changelog.md
$ my-project changelog.md
my-project · 18 weeks since launch
week 1✓product shipped
week 3✓first paying customers
week 4✓shipped the feature they kept asking for
week 6✓passed 100 users, nothing broke
week 7✓4.9 average across 60 reviews
week 9✓traffic tripled, same infrastructure
week 11✓shipped the public API
week 14✓brought on the first contractor
week 18✓you are scaling the product
0 incidents, 0 weeks wasted on plumbing
$ my-project changelog.md
my-project · 18 weeks since launch
week 1✓product shipped
week 3✓first paying customers
week 4✓shipped the feature they wanted
week 6✓passed 100 users, nothing broke
week 7✓4.9 average across 60 reviews
week 9✓traffic tripled, same infra
week 11✓shipped the public API
week 14✓brought on the first contractor
week 18✓you are scaling the product
0 incidents, 0 weeks wasted on plumbing

02 / priority

Reliability.

Not flashy good-to-have features. Load-bearing infrastructure your product's survival depends on.

Edge Request Identity Data Storage Async Billing Verified 100+ CONTROLS
Layer 01

Edge

nonce CSPstrict-dynamictwo policies, by folderbase-uri 'self'HSTS · 1y · subdomainsconnect-src allowlistframe-ancestors 'none'Referrer-Policyform-action 'self'CSP violations reported
Layer 02

Request

same-origin CSRF checkopen-redirect guardZod-validated envrate limit · degrades, never opensin-memory fallbackconfig fails the buildevery outbound call is time-bounded
Layer 03

Identity

role from DB per callgetClaims() verifiedgetSession() lint-bannedrequireUser() boundarypinned cookie optionsadmin only via SQLrequireAdmin()TOTP two-factoraal2 step-up gateadmin can unenroll
Layer 04

Data

column grantsRLS policies11 ordered migrationsprivileges asserted in CIreplay from emptyserver-only clientGDPR erasure, orderedGDPR export · Article 20
Layer 05

Storage

signed upload URLssigned download URLspath validationupload size limitsorphan sweepstep-up on signed URLsmime allowlist, in the bucket
Layer 06

Async

after() handoffFOR UPDATE SKIP LOCKEDexponential backoffcircuit breakerdead-letter stateno queue serviceadmin requeue
Layer 07

Billing

Stripe checkoutidempotency keyssignature verifiedprice ids server-onlyreplayable eventscancel before deletequotas fail closed
Layer 08

Verified

304 unit tests23 e2e testscontract drift testslint · types · test · e2epnpm audit --prodmigration replayproduction buildprivilege assertionsCLI lint gate
Layer 01

Edge

nonce CSPstrict-dynamictwo policies, by folderbase-uri 'self'HSTS · 1y · subdomainsconnect-src allowlistframe-ancestors 'none'Referrer-Policyform-action 'self'CSP violations reported
Layer 02

Request

same-origin CSRF checkopen-redirect guardZod-validated envrate limit · degrades, never opensin-memory fallbackconfig fails the buildevery outbound call is time-bounded
Layer 03

Identity

role from DB per callgetClaims() verifiedgetSession() lint-bannedrequireUser() boundarypinned cookie optionsadmin only via SQLrequireAdmin()TOTP two-factoraal2 step-up gateadmin can unenroll
Layer 04

Data

column grantsRLS policies11 ordered migrationsGDPR erasure, orderedprivileges asserted in CIreplay from emptyserver-only clientGDPR export · Article 20
Layer 05

Storage

signed upload URLssigned download URLspath validationupload size limitsorphan sweepstep-up on signed URLsmime allowlist, in the bucket
Layer 06

Async

after() handoffFOR UPDATE SKIP LOCKEDexponential backoffcircuit breakerdead-letter stateno queue serviceadmin requeue
Layer 07

Billing

Stripe checkoutidempotency keyssignature verifiedprice ids server-onlyreplayable eventscancel before deletequotas fail closed
Layer 08

Verified

304 unit tests23 e2e testsmigration replaycontract drift testslint · types · test · e2epnpm audit --prodproduction buildprivilege assertionsCLI lint gate

03 / setup

Speed.

One command to set the infrastructure up. One command to integrate your product details in it.

infrastructure
zsh : ~/projects
>
product
claude code : my-project
>

04 / stack

Efficiency.

Complete production stack. Four accounts, one deployed service.

Vercel Supabase Stripe Resend Upstash Sentry OpenTelemetry PostHog 3 REQUIRED
Hosting · required

Vercel

one deployed servicepreview per branchedge networkzero config
Database, auth, storage · required

Supabase

PostgresRLS and column grantsAuth: email, OAuth, resetStorage with signed URLsthe job queue lives here too
Payments · required

Stripe

checkout and billing portalwebhook signature verifiedidempotency on every mutationplan tiers, monthly and annualcancelled before account deletion
Transactional email · optional

Resend

typed templatesplain fetch, no SDKwelcome, reset, receipts
Rate limiting · optional

Upstash

sliding windowin-memory fallbackdegrades, never opens
Errors · optional

Sentry

is it broken?source-mapped stack tracesunset and it is simply off
Tracing · optional

OpenTelemetry

why is it slow?any OTLP collectorunset and it is simply off
Product analytics · optional

PostHog

does anyone care?ships unmountedcookie consent included
Hosting · required

Vercel

one deployed servicepreview per branchedge networkzero config
Database, auth, storage · required

Supabase

PostgresRLS and column grantsjob queueAuth: email, OAuth, resetSigned URLs
Payments · required

Stripe

checkout + portalwebhook signature verifiedidempotencyplan tierscancellation-first
Transactional email · optional

Resend

typed templatesplain fetch, no SDKwelcome, reset, receipts
Rate limiting · optional

Upstash

sliding windowin-memory fallbackdegrades, never opens
Errors · optional

Sentry

is it broken?source-mapped stack tracesunset and it is simply off
Tracing · optional

OpenTelemetry

why is it slow?any OTLP collectorunset and it is simply off
Product analytics · optional

PostHog

does anyone care?ships unmountedcookie consent included

05 / maintenance

Degradation watchdog.

I made the boilerplate good. Enforced rules make sure it stays good. Your agent breaks one, the build goes red.

written

            

              

            

          

        

      

      

        
enforced

        

          
pnpm test

          

        

      

    

  









  

    
06 / pricing

    
Buy it once. It's yours.

    
No nonsense, no subscriptions, no "updates for a year". You get the repository and the licence.


    

      

        
Solo

        
$149$249

        
one-time · limited for the first 20 licences

        
    
          
  • Full private repository, permanent access
    • 
          
  • The /integrate skill and every rule file
    • 
          
  • Commercial licence, unlimited personal projects
    • 
          
  • One developer
    • 
        

        Get the code
      

      

        
Team

        
$499

        
one-time · per company

        
    
          
  • Identical code the difference is the licence
    • 
          
  • Access for your GitHub organisation
    • 
          
  • Unlimited developers inside the company
    • 
          
  • Client work permitted (agencies)
    • 
        

        Get the team licence
      

    

  







  

    
07 / decision

    
Before you decide.

    
Proof you can re-run yourself, and the questions I would be asking.


    

      

        
Independent checks

        

      

        
securityheaders.com

        
A+

        
HTTP security headers. Nonce CSP, HSTS, frame and referrer policy, permissions policy.

        Re-run this scan →
      

      

        
Mozilla Observatory

        
A+ / 115

        
Deeper pass: CSP composition, cookie flags, TLS configuration, subresource integrity.

        Re-run this scan →
      

      

        
Lighthouse

        

          100PERF100A11Y100BEST100SEO
        

        
Google's audit of the deployed app, on a throttled mobile connection.

        Re-run this scan →
      

    

      

      

        
The awkward questions

        

      

        Is this boilerplate the right fit for me?
        

        

          

            
Yes, if

            
    
              
  • People sign up for your product as individuals, not as companies with staff accounts.
    • 
              
  • You're starting something new rather than moving an existing product across.
    • 
              
  • It's a normal web app: accounts, payments, file uploads, work happening in the background.
    • 
              
  • You want to own the code, with nothing extra to rent every month to keep it running.
    • 
            

          

          

            
No, if

            
    
              
  • Your customers are companies, and people inside them need their own logins and permissions.
    • 
              
  • You already know you need it to be fast for users on the other side of the world.
    • 
              
  • Your product has to do things on a timer, like nightly reports or weekly emails.
    • 
              
  • A single task takes minutes rather than seconds, like processing video or importing enormous files.
    • 
            

          

        

        
Having doubts or concerns? Run them by me before you decide.

        

      

      

        Why not just buy one of the popular ones?
        

        
Most boilerplates go all-in on easy setup and pretty design, because that's what the "I want to launch and get rich TODAY" market demands. The problem is that it's often done at the expense of everything you can't see in a demo, leaving you with a pretty homepage and a shitstorm of problems. My boilerplate too gets you to launch fast (see section 03). The difference is that I unequivocally put security and reliability first.

        

      

      

        What do I need installed?
        

        
Node 20+, pnpm, the Supabase CLI, and accounts on Supabase, Vercel and Stripe. The rest of the techstack is optional and up to you, the platform works either way.

        

      

      

        Do I get updates?
        

        
You get the repository as it stands on the day you buy, and you keep access to it. There's no maintenance schedule, but if I ship something significant, you'll have it.

        

      

      

        Can I get a refund?
        

        
Yes, in one specific case. The repo ships pnpm check. It checks your Node and pnpm versions and your keys, then runs the type checker, the full test suite and a production build, and tells you which side the problem is on.

        
If it says the code is broken on a clean clone and I can't fix that within 48 hours, you get a full refund and I won't argue about it. If it says your Node is out of date or a key is missing, that's your setup rather than my code — I'll gladly help you through it, but it isn't grounds for a refund.

        
Beyond that, no. It's source code, and once you've cloned it you have it.

        
One thing worth saying plainly: this assumes you're comfortable running commands in a terminal and managing your own accounts. If that's new to you, this isn't the right purchase, and I'd rather tell you now than take your money.

        

      

      

        Isn't your boilerplate also AI slop?
        

        
No, it's the furthest thing from it. This boilerplate was indeed built with the help of AI, but it's a product of many months of meticulous development, crash testing and endless code reviews, all under heavy human supervision. AI coding is not the problem – sloppy coding is. 304 tests, lint rules that fail the build, a nine-gate CI pipeline, and a contract layer are enforced to keep the next ten thousand lines of code as good as the first.