DevSecOps starter
A practical start
for your next app.
A Next.js starter with rate limiting, role-based route checks, and password authentication already connected. Use it as a starting point, then adapt it to your app.
Ships with
Common setup, already wired together
Request proxy
Checks sessions and protected paths before the app renders a page.
src/proxy.tsRate limiting
Upstash sliding window: 10 requests per 10 seconds per IP. Over-limit requests get a 429 response.
src/lib/ratelimit.tsRBAC sessions
Signed, httpOnly HS256 session cookies. The admin and member routes check the user role.
src/lib/session.tsPBKDF2 auth
Web Crypto PBKDF2 hashing with 210,000 iterations and a per-user salt.
src/lib/password.tsPluggable users
Raw Supabase client queries when configured, with an in-memory demo fallback. No ORM or profile management yet.
src/lib/users.tsHardened headers
CSP, HSTS, X-Frame-Options and Permissions-Policy locked into next.config.ts.
next.config.tsCost defense
Reject excess requests before app routes do their work
The proxy checks a per-IP Upstash sliding window before auth checks, page rendering, or database queries. This can reduce downstream work; it does not cap hosting, Redis, or network charges, and the Redis check itself runs on each matched request.
Browser, bot, or API client
10 requests / 10 seconds / IP
Route, then database if needed
Over-limit requests receive HTTP 429. If Redis errors, this starter fails open; configure provider-level traffic and spend limits too.
Skip the repeated setup
A working baseline you can adapt
| Milestone | Build yourself | Starter includes |
|---|---|---|
| Request checks | Choose and wire up a proxy | Working src/proxy.ts |
| Rate limiting | Pick a store, set policy, handle errors | Upstash sliding window + fail-open behavior |
| Auth foundation | Implement sessions, password hashing, route checks | PBKDF2, HS256 sessions, login and registration |
| Headers and CI | Configure, review, and maintain | Security headers and GitHub Actions workflows |
Time varies by product and experience. This starter does not include social login, MFA, ORM models, user administration, or subscription management.
Try the auth flow
Try the protected routes
Sign in with the demo account or create a local demo user. The admin page is a status example; it does not manage users.
Requests checked before protected routes · Sessions verified per request
Get the code
Start with the foundation. Build your app on top.
Get the starter source, its tests, and deployment examples with a one-time purchase. Lifetime updates are included.