DevSecOps starter

Secure by default.
Zero bloat.

A hyper-constrained Next.js boilerplate with rate limiting, edge RBAC and PBKDF2 auth baked in — so a viral spike can't bankrupt you and guests never see a byte they shouldn't.

Ships with

Everything the boring, expensive setup would take weeks of

Edge proxy

Every request passes the bouncer before React renders. Guests never see a flash of protected content.

src/proxy.ts

Rate limiting

Upstash Redis sliding window — 10 req / 10 s / IP. The infrastructure death spiral stops at the door.

src/lib/ratelimit.ts

RBAC sessions

Signed, httpOnly HS256 JWTs verified at the edge. /admin is admin-only; /dashboard for members.

src/lib/session.ts

PBKDF2 auth

Password hashing via Web Crypto — 210k iterations, per-user salt, zero native dependencies.

src/lib/password.ts

Pluggable users

Supabase/Postgres when configured, env-seeded fallback when not. Same fail-open spirit as Redis.

src/lib/users.ts

Hardened headers

CSP, HSTS, X-Frame-Options and Permissions-Policy locked into next.config.ts.

next.config.ts

Try the auth flow

Watch /admin bounce a guest, then let them in like a bouncer.

Demo credentials: admin / admin123 — or create your own account in a click. It's the same code a buyer would get.

Try /admin Create account

Rate limited at the edge · Sessions verified per request · A template, not a toy

Get the code

Stop rebuilding auth. Ship the thing that makes money.

The entire repo — edge proxy, rate limiter, RBAC, tests, deploy pipeline — for one payment, with lifetime updates. You're looking at the live product, not a mockup.

Buy the starter Try it first

Secure by default.Zero bloat.