CSP · CSRF · CVE < 24h
i. security
Locked by default.
Sanitized renderers. CSRF, secure cookies, SameSite=Lax, CSP-ready. Dependabot wired to ship advisories.
Launching soon · 21 starters in the catalog
Production-grade
application starters,
on a subscription.
Complete frontend applications you can clone, brand as your own, and ship. Every starter is hand-built, audited, and licensed for commercial use — so the first weeks of a new product go to your features, not the plumbing underneath them.
~/my-app
# after subscribing $ git clone https://x-access-token:<t>@github.com/forstarters-io/notes.git my-app cloning into 'my-app'… $ cd my-app && npm install added 364 packages in 6s $ npm run dev ▸ vite dev server ready in 487ms ▸ local: http://localhost:5173 ▸ msw: 'enabled' — 21 starters mounted
In the box
- Complete app — routing, state, mocks, theming, tests, CI.
- Six pillars — security, reliability, observability, performance, accessibility, testability.
- Per-app spec — read the contract before you pay.
- Maintained — security patches, framework upgrades, git pull to receive them.
- Commercial license — modify, brand as your own, ship.
spec/notes.md
live demo
21
/ 21
Built on
typescript · tanstack-router · tanstack-query · tailwindcss · msw · vitest · playwright ·
/catalog
21 complete applications. One shared stack.
Every starter ships with a hosted live demo, the full public spec, and a candid "what you'll still build" page so you know the scope before you clone.
Category
Status
calendar
in review Calendar
Month, week, and agenda views; create / edit / drag-to-reschedule; recurrence with end conditions; timezone-aware rendering. The hard problem is correctness — DST and cross-zone display must be right.
@js-temporal/polyfillrruleical.js
v 0.1.0 spec →
chat
in review Chat
1:1 and group chat with conversation list, threaded messages, presence, optimistic send, and infinite history. MSW WebSocket handler so the client uses a normal WS API.
msw-wstanstack-virtualemoji-mart
v 0.1.0 spec →
chatbot
in review Chatbot
AI chat surface on Vercel's AI SDK v6: streaming responses, tool-call visualization, regenerate / edit / fork, syntax-highlighted code, math, image attachments. Swap MSW for any AI-SDK-compatible backend in one line.
ai@ai-sdk/reactshiki
v 0.1.0 spec →
commerce
in review Commerce
Storefront, persistent cart, and a multi-step validated checkout. Demonstrates form depth, currency math correctness, and persisted client state.
zustand-persistembla-carouseltanstack-table
v 0.1.0 spec →
contacts
in review Contacts
CRUD contacts manager with virtualized list, validated edit form, avatar cropping, and fuzzy search. The canonical list/detail/form pattern reused by other starters.
tanstack-virtualtanstack-tablereact-easy-crop
v 0.1.0 spec →
dashboard
in review Dashboard
Config-driven analytics dashboard. Widgets follow a shared protocol so a new chart drops in as a file plus a config entry. Drag-to-rearrange, accessible tables and charts.
react-grid-layoutvisxreact-simple-maps
v 0.1.0 spec →
email
in review Tri-pane email client with folders/labels, conversation grouping, rich-text compose, search, and a strong keyboard-shortcut surface. Sanitized rendering of untrusted HTML.
tiptapcmdkreact-hotkeys-hook
v 0.1.0 spec →
freehand-canvas
in review FreehandCanvas
Pressure-sensitive freehand drawing surface. Pointer samples become tapered SVG outlines via perfect-freehand. Layered drawings, per-stroke undo, faithful exports.
perfect-freehand@use-gesture/reactdnd-kit
v 0.1.0 spec →
image-editor
in review ImageEditor
Non-destructive image editor with crop, rotate, flip, brightness/contrast/saturation, and a small filter set. Effects compose through WebGL for real-time previews on large images.
reglcomlinkfile-type
v 0.1.0 spec →
/how
From subscribe to ship.
Sign in, pick a starter, clone the source, replace the mock API with your own. The first starter is on the house — no card to evaluate.
- 01
Sign in with GitHub.
One account, no passwords.
- 02
Read the spec.
Every starter ships with a public plans/<app>.md spec — read it before you decide.
- 03
Pick a plan.
Self-serve via Stripe. Change plans, prorate, or cancel from your account.
- 04
Clone the source.
Use the per-starter GitHub token to clone the repo, or download a signed zip.
- 05
Point at your backend.
Replace the mock API with your own. Pull updates later with git pull .
notes.app — localhost:5173 ⌘ K
notes / inbox / launch-week.md
Launch week — what's left.
The note app from the catalog. Markdown, search, tags, autosave — all running locally against the mock API right now. The screenshot is the live demo. Open it in a new tab and try it.
When you clone, this same view ships with it. Point the API client at your backend and the rest keeps working.
autosaved · 04:32:11 218 words · saved local
Hosted demo of every starter — no signup required. Open demo →
/pillars
Six pillars, wired in by default.
Security, reliability, observability, performance, accessibility, and testability — wired in before you clone, not bolted on later.
unhandled < 0.1%
ii. reliability
Errors are events.
Boundary handlers, retry policies, idempotent mutations. PostHog-fed error tracking from the first commit.
trace 100% prop.
iii. observability
Things you can see.
Defined event taxonomy. Sampled session replay. Trace IDs stitched from server to client.
LCP < 2.0s p95
iv. performance
Time to interactive.
Bundle budgets enforced in CI. Route splits. List virtualization where it earns its keep.
axe issues = 0
v. accessibility
For everyone.
WCAG 2.2 AA. axe in CI. Keyboard-first. Focus trap on every modal. Reduced-motion respected.
boundary cov > 90%
vi. testability
Tests that mean it.
Vitest + Playwright. MSW fixtures. Coverage enforced at the boundary, not at every line.
/mock
The mock API is designed to be replaced.
Every starter ships against a mock API with a fixed contract. Point the same call sites at your real backend — Supabase, Convex, your own Hono — and the frontend keeps working.
- Realistic fixtures — built for testing edge cases, not Lorem ipsum
- Same response shape your real backend will return
- Subscriber recipes for Supabase, Hono, Convex, or your own stack
src/mocks/handlers/notes.ts before
import { http, HttpResponse } from 'msw' import { db } from './fixtures' export const handlers = [ http.get('/api/notes', async ({ request }) => { const q = new URL(request.url).searchParams.get('q') return HttpResponse.json(db.notes.list({ q })) }), ]
src/api/notes.ts after · supabase
import { supabase } from './client' export const notes = { list: async ({ q }) => { let q1 = supabase.from('notes').select() if (q) q1 = q1.textSearch('body', q) const { data, error } = await q1 if (error) throw error return data }, }
/who
Built for the engineer who picks the stack.
Indie founders
Start with auth, state, routing, theming, and tests already wired in. Spend your first weeks on the product, not the plumbing.
Boutique agencies
Use the same baseline for every client project. New hires read one stack, not five.
Startup CTOs
Internal tools at startup speed. Engineers move between projects without re-learning the boilerplate.
Educators & learners
Read production code end-to-end. The public spec explains what the source is doing and why.
/pricing
Pricing, in plain English.
Every tier includes the whole catalog. Tiers differ only in how many active deployments per starter you're allowed. Annual saves roughly two months a year.
Solo
$29 /mo
Indie. One product, one founder. $290/yr — saves $58
- Entire catalog
- 1 deployment per starter
- Update notifications & diffs
- Subscriber-only docs
Studio
$99 /mo
Small teams & in-house tools. $990/yr.
- Everything in Solo
- 3 deployments per starter
- White-label for in-house tools
- Priority support inbox
Agency
$249 /mo
Client work, unlimited deployments. $2,490/yr.
- Everything in Studio
- Unlimited client deployments
- Reseller-friendly white-label
- SSO via GitHub orgs
/maintained · every tier
Patches arrive on cadence. `git pull` to receive them.
When a CVE hits a dependency every starter uses, we patch the catalog and ship within days — not at your next manual audit. Advisories surface first in the source monorepo, propagate to every affected starter, and land in your inbox plus the in-product changelog. You merge on your schedule.
- Security patches across the catalog when an advisory lands
- Framework upgrades with tested migration paths
- A diff view in the in-product inbox before you pull
- Security notifications are non-unsubscribable; everything else is opt-in
Education
Bootcamps, college programs, and paid-course authors. Multi-seat annual contracts, negotiated. Email education@forstarters.io with seat count and program details.
You can
- Use the source commercially
- Modify it freely
- Brand it as your own
- Ship it to your customers
You cannot
- Resell the source as-is
- Redistribute as a competing starter pack
- Sublicense the catalog
/faq
Honest answers.
› When does it launch?
Soon. Drop your email on the waitlist and you'll get a note the day subscriptions open. No marketing in between.
› What does the subscription include?
Every starter in the catalog. The full source, the public spec, a hosted live demo, update notifications when versions ship, and the subscriber-only integration recipes.
› Is there a free trial?
No standing free tier — every starter is a subscriber asset. Evaluation runs on the public per-starter spec, the hosted live demo, and a 14-day money-back window on your first paid subscription. After 14 days, refunds are case-by-case.
› Can I use the source in commercial products and client work?
Yes. Use it commercially, modify it freely, brand it as your own, ship it to your customers. The Agency tier covers unlimited client deployments. You cannot resell the starters as templates or republish the catalog itself.
› What happens to my downloads if I cancel?
Anything you've already cloned keeps working in the products you've already shipped. Cancellation ends your right to new downloads and new deployments, not your right to keep running what's live.
› How do I get the source?
Each starter lives in its own private GitHub repo. After you subscribe, a GitHub App issues per-subscriber clone tokens. You can also download a signed zip if git isn't an option.
› How often do new starters ship?
Roughly one new starter or starter version every two to four weeks. RSS at /changelog/feed.xml once releases begin.
› Who keeps the starters current after I subscribe?
We do. When a CVE hits a dependency the catalog uses, we patch every affected starter and ship within days. Security advisories, framework upgrades, and routine version bumps all flow through the same release pipeline — you `git pull` to receive them. The security notification category is non-unsubscribable; everything else is opt-in.
› What if I need a refund?
Within 14 days of your first paid subscription, email billing@forstarters.io for a full refund — no questions. After 14 days, refunds are case-by-case.
launching soon
Skip the plumbing. Start with something that ships.
Read the spec. Watch the demo. Be first in line when the catalog opens — the first starter is on the house.