Changelog
Everything we've shipped
The boilerplate ships changes continuously. Here is what landed in each release, newest first.
Actively maintainedDemo mode: ship a live, read-only demo of your SaaS with one env var
- DEMO_MODE serves a sealed, read-only dashboard from seeded sample data
- Fail-closed by design: never opens next to a live Stripe key or real database
- Auth bypass scoped to the dashboard, with a read-only banner and noindex
- User avatars load cleanly under the strict CSP and COEP headers
Stripe billing: subscriptions + signed webhooks, end to end tested
- Subscription checkout and a customer portal wired to Stripe
- Signed webhook handler covering the full subscription lifecycle
- Entitlement checks that gate paid features by plan
- Unit tests across the billing-critical paths
Email: Resend support added (Mailgun still works)
- Provider-agnostic mailer with Resend and Mailgun behind one interface
- Switch provider with an environment variable, no code changes
- Transactional templates for the auth and account flows
Serverless-ready: durable config, feature flags, audit log and distributed rate limiting
- Config, feature flags and the audit log persisted in storage, durable across serverless invocations
- Distributed rate limiting via Upstash, safe on serverless and edge runtimes
- No in-memory state to lose between cold starts
Security: session CSRF, admin access control, rate limiting
- CSRF tokens validated on every mutating request
- Role-based access control on the admin dashboard and APIs
- Rate limiting across auth, sensitive and general routes
- Audit logging for security events
Built for coding agents: Claude Code skills, llms.txt and a scriptable devtool
- Claude Code skills for the repo's conventions (scaffold-feature, add-api-route, add-ai-provider)
- llms.txt plus CLAUDE.md, AGENTS.md and .cursorrules so agents build on-pattern
- Non-interactive devtool CLI with a feature generator (Zod model, 4-part API route, test)
AI engine: streaming Claude + OpenAI, built-in assistant page
- Provider-agnostic AI layer (Anthropic + OpenAI) behind one interface
- Streaming chat endpoint with session gating and rate limiting
- Assistant page in the dashboard with a provider and model picker
