S SaaS Boilerplate
ID
GitHub
Features

Everything the boilerplate does out of the box.

Grouped by concern. Every item here is code you would otherwise write yourself.

01

Authentication

  • + Email + password with hardening (min length, bcrypt, verification)
  • + OAuth via Google and GitHub, extensible per provider
  • + Password reset with signed tokens
  • + Session cookie: HttpOnly, SameSite=lax, Secure in production
  • + Organization plugin: workspaces, members, invitations, roles
  • + requireActiveOrg + requireRole helpers on every mutation route
02

Billing & Payments

  • + Duitku adapter (VA, e-wallet, QRIS) with signature verification
  • + Provider-agnostic interface — Midtrans, Xendit, Stripe drop-in
  • + Webhook idempotency with (provider, reference) deduplication
  • + Terminal states (paid/refunded) enforced by the state machine
  • + Plans + subscription lifecycle wired end-to-end
  • + Integer minor units — no floats, currency stored separately
03

Developer experience

  • + Bun 1.3 for install, dev, build, test — one tool
  • + TypeScript strict mode across every workspace
  • + Biome for lint + format (fast, zero config)
  • + Drizzle migrations checked into the repo
  • + OpenAPI docs auto-generated from Hono routes
  • + Docker Compose for Postgres + Redis + Mailpit in one command
04

Security

  • + CSP, HSTS, X-Frame-Options, Referrer-Policy via hono/secure-headers
  • + Rate limit: sliding window per IP, stricter on auth routes
  • + Timing-safe webhook signature verification
  • + Column-level encryption helper for secrets at rest
  • + Debug logs gated to NODE_ENV === development
  • + Security-conscious defaults following OWASP guidance
Start today

Start from further along.

If auth, billing, or multi-tenancy has stalled you before — those parts are done here. Clone the repo and build.

View on GitHub Read the docs