SaaS Foundation Kit — a Next.js SaaS starting point (self-hosted edition)

Engineering & Development

An account system (JWT + bcrypt, not tied to an external auth service) plus Postgres, teams / roles / an activity log and a Stripe subscription skeleton: docker compose up brings the site up, with migrations run automatically and a demo account included.

Subscribe & download See how to start

SubscriptionUS$49 per month

Last run2026-11-02

In practice

Readiness5 / 5

What you need

Few changes needed4 / 5

Who it is for

Solo developers and small teams starting a new SaaS: people who want a starting point with accounts, teams and a subscription skeleton already wired up, and who want the whole thing to run on their own machine or VPS rather than being locked into hosted services such as Vercel, Clerk or Neon.

How to start

$ scripts/init-env.sh
$ docker compose up -d --build

Browse the files

Files in the product repository at the pinned commit. A few house files are left out of the zip.

File overview64 paths

▸app23

(dashboard)/
(login)/
api/
favicon.ico
globals.css
layout.tsx
not-found.tsx

▸components7

ui/

▸lib13

auth/
db/
payments/
utils.ts

▸scripts1

init-env.sh

▫ATTRIBUTION.md

▫Dockerfile

▫LICENSE

▫LICENSE-99LL

▫PRODUCT.md

▫QUICKSTART.md

▫README.md

▫SECURITY.md

▫components.json

▫compose.yaml

▫delivery-manifest.txt

▫drizzle.config.ts

▫middleware.ts

▫next.config.ts

▫package.json

▫pnpm-lock.yaml

▫postcss.config.mjs

▫tsconfig.json

▫Config and hidden files 2

Latest passing run

Clone → Checkout → Toolchain → Build → Run live

Pre-purchase Disclosure

What you are buying

The source code of a SaaS site that runs on your own machine: once docker compose has started there is sign-up and sign-in (JWT + bcrypt, with no external auth service), team and role management, an activity log, and subscription checkout wired up to Stripe; migrations run automatically.

Derived from an MIT-licensed open-source SaaS starting point; the containerisation, the graceful degradation to Stripe placeholders, making the seed idempotent, and the Traditional Chinese documentation are ours. Delivery is a frozen snapshot: one zip file, taken from the product repository at revision 1d1a6cb.

Known limitations

The delivered configuration listens on port 3000 over plain HTTP by default, with no TLS and no reverse proxy
The demo account [email protected] / admin123 and the database credentials postgres / postgres are publicly known values
Subscription checkout, the webhook and the Stripe customer portal need your own Stripe keys; with the placeholder values in place, pressing checkout will fail
Data lives in a Docker volume, and docker compose down -v deletes the database along with it
The first start fetches over the network: it pulls the base images, installs the npm dependencies, and downloads Google Fonts at build time
Pinned to the delivered snapshot; it does not follow upstream.

The liability cap, the scope of what is promised and the statutory floor are governed by the Terms of Service.

Vetting record

Everything below was checked against the pinned commit 6e33e58. Every verdict carries its full reasoning, an evidence link and the checker; failures are published, not hidden — do not take our word for it, verify it yourself.

5 PASS0 WARN0 FAIL

Source ReviewPASS

app/, lib/, components/ and middleware.ts were scanned file by file: no eval, no new Function, no dangerouslySetInnerHTML; the only child_process is in lib/db/setup.ts (an interactive development helper script that runs only when pnpm db:setup is invoked explicitly, and the container start-up path does not go through it); the only outbound connections at runtime are the Stripe API (when keys are configured) and its own Postgres; the external URLs on the pages are all links to documentation or deployment instructions.

Script SafetyPASS

The package.json scripts are standard next / drizzle-kit / tsx commands, with no postinstall or prepare install hooks; scripts/init-env.sh produces a local .env only when the buyer runs it explicitly, and makes no outbound connection; db:setup (an upstream interactive script) calls the stripe CLI and docker, but it is not on the container start-up path and QUICKSTART does not use it.

RecencyPASS

The derivative repository is pinned at a specific commit (see the evidence link) and does not follow upstream.

LicensePASS

SPDX:LicenseRef-99LL-Product

Upstream is MIT: the LICENSE itself at the pinned commit 6e33e58b1e553a41fe22e6b941a7229a002de361 was read word for word (the standard MIT text, Copyright 2025 Vercel), and the root LICENSE is kept verbatim; our sale terms = LICENSE-99LL (99LL product licence template v1).

Dependency LicensesPASS

No GPL / AGPL / BSL among the dependencies. The base images node:22-alpine and postgres:16-alpine are distributed with the images under their own licences and do not go into the buyer zip (the zip delivers the source tree).