AVAILABLE NOW
The NextJS and Rust SaaS Kit is a production-ready starting point for a SaaS product. One repository holds a Next.js 16 frontend and a Rust 1.97 Cargo backend with PostgreSQL. The trees build independently: no root package manifest, no monorepo orchestrator.
The account surface is complete. Customers can register, verify email, sign in, sign out, and reset a forgotten password. Sessions are opaque tokens stored as SHA-256 hashes, expiring after 12 hours absolute or 30 minutes idle. Passwords are screened against common-password and Have I Been Pwned lists, then stored as argon2id hashes. Login rate-limits per email and globally, locks an account for 15 minutes after five consecutive failures, and alerts the owner. Responses never reveal whether an address exists; verification and reset tokens are single-use.
Behind the accounts sit a provider-agnostic billing trait with HMAC-signed mock webhooks driving entitlements, an admin-only page rendering account state, and production operations: structured tracing, an audit.* stream attributed by customer UUID only, and per-IP rate limiting.
The browser talks only to the Next.js server. The backend origin and application secret stay server-side; every account call proves the trusted caller with a constant-time secret and exact-origin check, then authorizes the user from the presented session.
Setup starts with one command: node scripts/bootstrap-dev.mjs creates the databases, writes aligned env files without overwriting them, migrates, and seeds a verified admin and subscriber. The kit's verification battery — Rust fmt/clippy/tests, supply-chain audits, frontend lint/tests/build, Playwright e2e, and a smoke-tested non-root Docker image — is what CI runs.
A foundation: no real payment provider, MFA, logged-in password or email change, or product data models beyond accounts and entitlements. TLS, network isolation, backups, secrets, and log retention stay with you, guided by the included operating contract.
WHAT YOU GET
Registration, email verification, login, logout, and password reset are implemented end to end on the Rust authority, with matching Next.js pages. Verification tokens are single-use with a 24-hour expiry, reset tokens with one hour, and no flow except login mints a session. A seeded verified admin and subscriber make the whole loop testable on first run.
Login returns a 32-byte random token once; the database stores only its SHA-256 hash. Sessions expire after 12 hours absolute or 30 minutes of inactivity, enforced on every account call. Logout revokes only the presented session and is idempotent. A completed password reset revokes every session for the account in the same transaction.
Passwords must be at least 12 characters, pass a common-password list, and survive Have I Been Pwned range screening that sends only the first five characters of the SHA-1 digest (k-anonymity). Hashes are argon2id at 64 MiB, 3 iterations, 1 lane. An HIBP outage fails open to the static policy and logs a warning instead of blocking signup.
A 15-minute sliding-window limiter (per process) covers per-IP traffic, login per email and globally, registration and resend, reset requests, and token attempts. Five consecutive failures lock a loginable account for 15 minutes and email the owner. Every login attempt runs exactly one argon2 verify and returns one 401 shape, so responses and timing stay uniform.
Verification, reset, already-registered, and suspicious-login messages go out through Resend over TLS with text and HTML bodies and escaped interpolation. Unknown addresses are shaded, responses are padded to a 750 ms anti-enumeration budget, and network calls time out after 2 seconds. Missing or short Resend configuration fails startup rather than failing silently.
The application depends on a BillingProvider trait, not a vendor SDK. The bundled mock provider signs and verifies HMAC-SHA256 webhooks in constant time. subscription.activated, subscription.cancelled, and payment.failed events update entitlement state, unknown customers are a no-op success, and adopting a real provider means implementing three trait methods. It is a foundation, not a payment integration.
An admin-only page renders account state for the signed-in administrator and redirects non-admins to the customer home. Capability is read from the backend /v1/me response, never from the page or the client. The seeded dev@example.test account exercises the admin path locally.
tracing emits one JSON object per line in production and readable lines locally. A closed event catalog covers lifecycle, HTTP, mailer, and security events, with request_id echoed on responses for correlation. The audit.* stream attributes by customer UUID only — never emails, tokens, passwords, or IPs — and secrets, tokens, and raw request bodies are never logged.
The browser talks only to the Next.js server; the backend origin and application secret exist only in server-side environment values, with no NEXT_PUBLIC_* exposure. Every account call proves the trusted caller with a constant-time secret check plus an exact-origin check, then authorizes the acting user from the presented session. Missing or weak required configuration stops startup.
node scripts/bootstrap-dev.mjs creates the development and isolation-test databases, writes aligned backend and frontend .env files without overwriting existing values, applies migrations, and seeds verified accounts. It runs on Ubuntu 24.04, native Windows 11 PowerShell, and WSL, prints random passwords once, and is safe to re-run.
One git repository holds a Next.js 16 App Router frontend and a Rust 1.97 Cargo workspace (Axum, sqlx/PostgreSQL). There is no root package manifest or monorepo orchestrator, no path dependency in either direction, and the frontend reaches product data only through the backend REST API. Each tree builds and tests on its own.
CI runs rustfmt, clippy with -D warnings, workspace tests, a release build on Rust 1.97, cargo audit, cargo deny, frontend audit-ci at high severity, ESLint, Vitest, a production build, and Playwright end-to-end tests. The backend image is a non-root (uid 10001) build with a /health healthcheck, published only by a manual workflow that smoke-tests it first.
BEYOND THE SOURCE
Every kit is built to be read and changed by hand. The documentation, examples, and agent context travel with the source.
MCP server, included. Generate a Personal Access Token in your account (one active token at a time) and add it to your agent's MCP configuration. Your coding agent can then discover the kits you own, pull their context and runbooks, and scaffold supported project and workflow files. Your code stays on your machine.
SIMPLE OWNERSHIP
Start with the kit that fits. Pay once for your license, with 12 months of updates and support included. Renew maintenance when you need it.
1 developer
$249 one-time
12 months of maintenance included from purchase
Optional renewal $99 / year
MCP access for your coding agent
Get SoloUp to 5 developers
$599 one-time
12 months of maintenance included from purchase
Optional renewal $249 / year
MCP access for your coding agent
Get TeamThis license covers NextJS Frontend + Rust Backend SaaS Kit. Licensing another kit is a separate purchase under the terms shown at checkout.
Amounts are in USD.
The license is a permanent right to use and modify the entitled code. Maintenance is access to new releases and product support, not the right to keep running what you already have.
The included 12 months run from your purchase anniversary, not from the calendar year.
When maintenance ends, existing applications keep running. Entitled versions remain yours to download and use. Expiry does not revoke that use.
After expiry, every newly released update — including critical security fixes — needs active maintenance. Notifications about known relevant security issues continue whether or not maintenance is active.
Renew early and the current expiry moves forward by 12 months. Renew after a lapse and a new 12 months starts on the renewal date, without a charge for the gap.
Your purchase covers the kit you chose. Licensing another kit is a separate purchase under the terms shown at checkout; it does not unlock every implementation in the collection.
MAKE IT YOURS
Inspect the kit and its documentation before you decide.