You should vibe code it, on top of this. AI gets you a demo in an afternoon; then come the parts nobody films. Payments: checkout, webhooks and access are wired for Stripe, Lemon Squeezy and Dodo, and a unique index stops a repeated webhook from recording the same sale twice. Data: agents get a read-only database handle, the database client blocks DROP, TRUNCATE and DELETE without WHERE, and on SQLite every migration takes a backup first. Deploys: lint runs before the build, and if the new build fails its health check the previous one goes back automatically.
Run your startupfrom your phone.
From your first idea to your first customer, build and launch your startup with AI, without spending weeks assembling the boring infrastructure.
- IncludedShip: one command, from your phone.
- IncludedUndo: one command, or on its own if a deploy fails.
- IncludedHear first: Telegram or Discord pings you when something breaks.
- IncludedAsk: ChatGPT or Claude how sales are going.
- IncludedAlready built: login, payments, analytics, blog.
- Included$5 server: No Vercel bill.
Take it for a spin.
The real BoringPush, running in your browser. Watch the tour, or just start clicking. Nothing you do here is saved.
Everything your startup needs. Already built in.
Pick any piece below. It's already wired up and in your repo on day one.
See everything that's included (16 features)
Analytics
You're paying for ads and can't tell which one brought the sale.
Most analytics count visits, not money. This one ties every payment back to where the customer came from, so you know which channel to double down on. A cookie-free mode is one setting away.
- Every pageview, with entry and exit pages
- Browser, OS and device read from each visit: Safari, Chrome, iOS, macOS and more
- Each visit sorted into a channel: search, social, AI assistants, email, paid or referral
- Revenue tied back to the channel that brought the buyer
- Kept in its own SQLite file (analytics.sqlite), no third-party service
- CSV export from the dashboard
- Funnel builder: pick the steps and see where people drop off
- UTM campaign breakdown
- Country, region and city from Cloudflare headers
- Buyer journeys: the visits before each first purchase
- Time from first visit to first purchase
- Events older than 90 days are cleared every day
Authentication
Someone finally tries your app. The login breaks.
The worst moment in a founder's life isn't the idea failing. It's someone finally finding your app — and the sign-in page breaking. Boring ships with Google sign-in, magic links, and a local dev login that works on every database, from your first commit.
- Google sign-in: one tap and they're in
- Magic links by email, once you set EMAIL_SERVER
- JWT sessions (Auth.js v5): no session table to read on every request
- The dashboard checks the login on the server, in its layout, before anything renders
- Dev login in one click, on your machine only: [email protected] acts like a paying customer
- Every new account records a signup event, so "how many signed up today?" has an answer
- Session provider wrapper for client components
- requirePaidUser() for pages, requireApiUser() for API routes
- Safe redirects after sign-in (safeUrl)
- Database adapters for SQLite, MongoDB and Supabase
- Stale-session guard: a deleted user is sent back to login
Multi-Provider Billing
Billing is where vibe-coded apps quietly lose money.
A webhook fires twice and a sale is counted twice, or not at all. Here, Stripe, Lemon Squeezy and Dodo are already wired behind one checkout route, repeated webhooks are ignored, and you can switch providers by changing one setting.
- One checkout endpoint for every provider: /api/billing/create-checkout
- Stripe, Lemon Squeezy and Dodo Payments adapters
- Repeated webhooks are ignored: an order is matched on its payment reference, and that reference is unique
- A customer portal link for each provider: /api/billing/create-portal
- Test your paywall locally with the [email protected] dev login
- Webhook signatures are checked for all three providers
- Dodo signature check (Standard Webhooks, no SDK)
- Lemon Squeezy signature check (HMAC-SHA256)
- Stripe signature check (constructEvent)
- Refunds and cancellations take access away (revokeAccess)
- Cancel a subscription: /api/billing/cancel-subscription
- A failed webhook sends you an alert
Incident Telemetry
Your app breaks at 2am. You find out from a customer at 9.
Not anymore. When a payment webhook fails, a sign-in breaks or the site throws an error, you get a short message on Telegram or Discord straight away. No Sentry subscription, no extra packages.
- Alerts go to Telegram or Discord, whichever you set up
- Each alert says what broke and carries the error details with it
- The same alert is sent at most once a minute, so one failure can't flood your phone
- Wired into the Stripe, Lemon Squeezy and Dodo webhooks, sign-in errors and site crashes
- Webhooks don't wait for the alert to send
- No packages: plain fetch
- Error details attached to the alert as JSON
- Browser crashes reach you through /api/telemetry
- Sign-in errors on the /auth page raise an alert
- In development, alerts print to the console when no channel is set
Zero-Lockin Engine
A $50 a month database bill before your first sale?
Run the whole app on a $5 server with SQLite: no database bill, no network hop, daily backups. When you outgrow one box, set DB_PROVIDER to supabase or mongodb and the app code stays the same. Moving your existing data over is up to you.
- SQLite in WAL mode, with a busy timeout, a 20 MB page cache and foreign keys on
- No database hosting bill: run the whole app on a $5 VPS
- No network hop: queries read a local file
- Same app code on Supabase Postgres or MongoDB: set DB_PROVIDER
- Writes that must not collide run in BEGIN IMMEDIATE transactions
- Scripts included: npm run db:migrate, db:optimize and backup:db
- db:migrate takes a backup before it changes the schema
- db:optimize runs PRAGMA optimize and truncates the WAL
- VACUUM to reclaim disk space (db:optimize and a monthly worker)
- SQLite errors turned into HTTP 409 and 422 answers
- Analytics kept in a separate file, analytics.sqlite
- backup:db keeps the last 24 snapshots
- Mongoose models for MongoDB
- Supabase tables in providers/db/supabase/schema.sql
In-Built Deploy
Paying Vercel and CI before anyone pays you?
Deploy to your own $5 server with one command. It builds on your laptop, swaps the new version in, and waits until the site is serving it. The previous build stays on the server, so one command puts it back. No Vercel bill, no GitHub Actions minutes.
- One command from your laptop: boringpush deploy. No CI service to set up or pay for.
- Lint runs first, then the build runs on your laptop and only changed files are sent, so the $5 server never builds.
- One-command rollback: boringpush rollback puts the previous build back, with no rebuild.
- Health wait: after the swap it waits until the new build is serving before it purges the cache. If it never does, it tells you to roll back.
- Docker route: boringpush docker ship rolls back on its own when the health check fails.
- Cloudflare cache purge limited to the pages your change touched.
- boringpush doctor checks Node, git, env file, database file and disk before you ship.
- bin/boringpush.mjs (operator CLI: doctor, status, deploy, rollback, docker, db migrate/check/backup)
- docker/Dockerfile (multi-stage Alpine image)
- scripts/deploy/ship.sh (lint, local build, delta rsync, swap, health wait)
- scripts/cloudflare/smart-purge.mjs (purge only the routes that changed)
- storage/logs/deploy.log (log of every deploy)
- nginx/boringpush.conf (reverse proxy, long cache for _next/static)
Silent Workers
Server full at 3am because nobody cleaned it up?
No Redis and no cron service to pay for. While you sleep, built-in routines back up your database, clear old logs and free disk space, so you wake up to a server that's still running.
- Runs from the server's own cron: setup installs the crontab for the app user, not root
- No pile-ups: if a job is still running, the next run skips instead of starting a second copy
- Nightly backup at 3am: VACUUM INTO snapshots in db/backups, the last 7 days kept
- Hourly WAL checkpoint stops the write-ahead file from growing
- Weekly log rotation, and analytics events older than 90 days cleared daily
- Runs from cron, outside your web requests
- Every minute: your own tiny jobs in scripts/workers/minute/
- Hourly: WAL checkpoint (wal-checkpoint.mjs)
- Daily: SQLite backup and analytics cleanup
- Weekly: log rotation that keeps log streams open (log-rotate.mjs)
- Monthly: VACUUM and PRAGMA optimize (vacuum-databases.mjs)
- Add a job by dropping a .mjs file into a period folder
Storage
One big upload and your $5 server falls over.
Most apps choke when a few users upload files at once. Here, files go straight from the browser to Cloudflare R2 or Amazon S3. Your server only signs the upload and checks it afterwards, and R2 doesn't charge for downloads.
- Uploads skip your server: the browser sends the file to a signed URL that expires in 2 minutes
- Cloudflare R2 or AWS S3: switch with STORAGE_PROVIDER
- No AWS SDK: SigV4 signing is done with Node's built-in crypto
- Login required to upload, and each user's files live under their own prefix
- After the upload the server checks the real size and type, and deletes files that break the limits
- Drop-in <FileDropzone /> with drag-and-drop and a progress bar
- uploadFileWithProgress() upload helper
- FileDropzone component
- SigV4 presigning (providers/storage/core/sigv4.js)
- Size and type checked on the server with a HEAD request
- Time-limited download links
- File names and keys built on the server; the client's file name is never used
Feedback Boards
Paying Canny every month just to hear what users want?
Public boards with voting, categories, comments and statuses are built in. Your users tell you what to build next, and you don't pay for another tool.
- Public boards that anyone can open and read
- Creating a board needs paid access; voting and commenting need a login
- One vote per signed-in user on each post
- Statuses the board owner sets: Open, Planned, In progress, Done
- Sort by Top or New, and filter by category
- Comments on every post
- Board settings screen for the owner
- Owner can remove a post; it is marked deleted and kept in the database
- bp boards and bp posts commands
- MCP tools to list posts, vote, comment and set a status
Agents Build It (.agents)
You ask the AI for one change from your phone. Production breaks.
That's what happens in a normal codebase. Here, AGENTS.md and the .agents/ rules and skills give Claude Code, Cursor or Antigravity one path to follow: data first, short routes, lint before it says done. They are instructions the agent reads, plus a few guards in the scripts, like production migrations being human-only.
- AGENTS.md and 8 rules in .agents/rules tell the agent how to work in this repo
- 9 skills in .agents/skills: build a feature, deploy, mobile session guard, responsive UI and the boring-filter set
- Schema first: new data goes into each database you use (SQLite, MongoDB or Supabase) before any screen
- API routes stay thin: check the input, check the login, make one provider call
- Migrations only add. db:migrate backs up first, and agents can't run it against production.
- The agent is told to finish with node --check and a zero-warning lint
- build-feature: data first, from schema to screen
- deploy-app: how to ship
- mobile-session-guard: rules for sessions started from a phone
- responsive-ui: layouts that fit phones
- boring-filter (5 skills): UI, copy, contrast and mobile layout checks
- 01-conventions: file layout and thin-route rules
Marketplace
Gumroad takes a cut of every sale you make.
Sell digital products from your own app. You list a product, buyers check out with Stripe, Dodo or Lemon Squeezy, and the order is recorded when the payment webhook arrives. BoringPush takes no cut; your payment provider's fees still apply.
- List a product from the dashboard. Stripe and Dodo prices are created for you; for Lemon Squeezy you paste the variant id.
- Listing is admin-only: the owner's account sells, buyers buy
- Each product opens a page you choose after payment (default /vault)
- Store dashboard with your products, your sales and the total earned
- Refunds and cancellations mark the order and take access away
- Buyers see what they bought at /dashboard/purchases
- Orders matched on the payment reference, so no double orders
- One-time or recurring prices
- Listings are soft-deleted and kept in the database
- Check on product image URLs
- bp products and bp orders commands
API Routes
Two hundred lines of AI spaghetti in every route?
Every endpoint is a short, plain Next.js route: check the input, check who's asking, call one function, return JSON. Easy for you and your AI to read, hard to break.
- 49 route handlers across 22 areas: auth, billing, boards, store, webhooks, MCP
- One login check for the browser and the CLI: requireApiUser()
- Paid pages and features behind one guard: requirePaidUser()
- Plain input checks against shared field limits (LIMITS), no extra library
- Webhook signatures checked for Stripe, Lemon Squeezy and Dodo
- JSON errors with standard HTTP status codes
- Scoped API tokens for the CLI (read or write)
- Rate limits on the MCP and repo-claim routes
- Admin-only checks on admin routes
- Safe redirect helper (safeUrl)
Terminal Control
Five dashboards open just to check on one customer?
Every feature has a command. See orders, grant a customer access, check revenue — from your laptop, your phone over SSH, or by handing your AI agent a key that can only do what you allow.
- Log in from the terminal: approve a short code in your browser, nothing to paste
- Commands for orders, products, users, boards, posts, analytics and billing
- Give your AI agent a read-only key, so it can look but not change
- Anything that changes data refuses to run without an explicit --yes
- Point the same commands at your live site with --remote
- Revoke any key in one command
- One small file adds a command for anything you build
- The same login and paywall rules as the website
- Keys expire after 90 days
- Only a fingerprint of each key is stored, never the key
- --json output for scripts and agents
- Covered by the end-to-end test
Agents Use It (MCP)
Your customers ask AI for everything. Is your app there?
Every app you build on BoringPush works with Claude, ChatGPT and any other AI assistant that supports MCP, from day one. You and your users run it by chat, read-only until someone allows changes.
- One tool list (mcp/tools.mjs) serves both the hosted /api/mcp address and the local server
- Connect from Claude, ChatGPT or any MCP client: add a connector with your app's /api/mcp address
- Sign-in is OAuth: users approve on your site, nothing to copy or paste
- Read-only by default; changes need a separate, explicit tick
- Revenue and analytics tools answer only for the app's admin, and there are no admin write tools
- Works locally too: Claude Desktop, Claude Code and Cursor
- Every AI request runs the same route, login and paywall checks
- Each connection is a key you can revoke in one command
- Rate-limited per connection, not per address
- Covered by the end-to-end test
- No new database tables
- Add a tool for your own feature with one catalog entry
AI Skills
Your AI ignores your rules and invents its own structure.
The built-in skills and rules teach Claude Code, Cursor and other agents how this codebase works, so they follow CONVENTIONS.md instead of making up new patterns. They are plain Markdown files the agent reads.
- 9 skills in .agents/skills, each a SKILL.md the agent loads when the task matches
- build-feature sets the order: scope, schema, provider, route, screen, checks
- Rules ban new npm packages and keep every entity's fields identical across databases
- The agent is told to run node --check, lint and a curl test before it says done
- Database rules: one provider surface, the same function names on every engine
- Plain Markdown: any agent that reads AGENTS.md can follow it
- deploy-app: how to ship
- mobile-session-guard: rules for sessions started from a phone
- boring-filter: UI, copy, contrast and mobile layout checks
- contrast-check.py: a contrast checker script
Blog & SEO
A blog shouldn't need a CMS, a database and a login.
No database models or CMS dashboards to log into. Drop .md files into a folder and your blog renders with code syntax highlighting, JSON-LD for Google, an XML sitemap and an RSS feed. A newsletter box saves emails to your own database.
- Drop .md files into features/blog/content/ and deploy: articles appear on the blog
- JSON-LD for each article, plus FAQ rich results from a ## FAQ section
- XML sitemap (made on every build) and an RSS feed at /rss.xml
- A newsletter box that saves emails to your own database
- Syntax-highlighted code blocks and a reading-time estimate
- Open Graph and Twitter tags for every post, using the post's cover image
- Tag pages for every tag
- Blog search
- Related posts under each article
- npm run blog:check to check your articles
- schedule-posts.mjs spreads publication dates
- Terms and privacy pages included
Your best ideas don't wait for your laptop.
Neither should you.
The idea hits on the train, in bed, at your kid's game. Founders already ship from their phones with Claude Code. Here's what they say about it.
You asked for one small change from the beach. Now nobody can log in.
That's what happens when an agent edits your live app directly. In BoringPush it doesn't: every change takes the same five steps from your laptop to your customers, and each step is a real command.
The safe loop
How BoringPush keeps agent changes from breaking what works
- Build locally
$ bp dev - Test it via the CLI
$ bp boards list - Pass the checks
$ npm run lint$ npm test
- Push
$ bp deploy --yes - Undo
$ bp rollback --yes
What it stops
Not includedPhantom packages
IncludedNo unapproved packagesThe agent rules ban new npm packages, so features use the Node.js and Next.js built-ins you already have.
Not includedLive data wiped
IncludedGuardrails on production dataThe database client blocks DROP, TRUNCATE and DELETE without WHERE. Agents read live data read-only, and production migrations need you.
Not includedRoutes that skip the paywall
IncludedThin routes, one shared checkAPI routes validate input, run one shared login and paywall guard, then make one call. Easy for you to review.
Not includedUnchecked code goes live
IncludedLint before every shipThe deploy runs lint first and stops on errors.
Not includedNo way back
IncludedA deploy that undoes itselfIf the live site fails its health check, the previous build goes back automatically. By hand it's bp rollback --yes.
Not includedTwo databases, two codebases
IncludedOne app code for every databaseBuilt-in features share one set of functions across SQLite, Supabase and MongoDB, and npm run test:matrix checks none is missing.
Rules live in AGENTS.md and .agents/ · works with Claude Code, Cursor, Antigravity and OpenCode
Agents use it (MCP)
Your customers can use what you build from ChatGPT, Claude, Cursor & more. From day one.
Your customers already ask AI for everything. If an assistant can't reach your app, it points them somewhere else, and you never see the sale you lost.
- Speaks MCP, the open standard Claude, ChatGPT and Cursor use to reach apps
- Customers approve once on your site, then just ask
- Read-only until they allow changes
- Each customer sees only their own data
- Every call runs your normal API routes, login and paywall checks
How's the app doing?Example
Ask your app anything…
Batteries included · production ready
Locked into a $50 bill before your first sale? Not here.
Start on one $5 server with SQLite. Every service below is already set up.
- Framework
Next.js 16
React 19
Tailwind CSS- Sign-in & email
Google
Resend
Magic links- Payments
Stripe
Dodo
Lemon Squeezy- Database
SQLite
Supabase
MongoDB- Storage & deploy
AWS S3
Docker
Cloudflare R2- Alerts & access
Telegram
Discord
Tailscale
Same app code on every database
Pick the wrong database and you rewrite everything. Here you flip one switch.
Write your schema once and your queries once. Start on SQLite, move to Supabase or MongoDB when you need to.
$5 server · SQLite
# Run app + db + analytics on a $5 server
DB_PROVIDER=sqlite
SQLITE_PATH=/var/data/app.db
BILLING_PROVIDER=dodo
✓ Sub-ms local reads · 100k+ ops/sec · $0/mo DB billSupabase cloud
# Point to Supabase with 1 environment variable
DB_PROVIDER=supabase
SUPABASE_URL=https://xyz.supabase.co
BILLING_PROVIDER=stripe
✓ Exact same models · Same queries · 0 lines changedCLI first · built-in deploy
Your own deploy. No $20 a month to host an idea.
One command, bp deploy, builds on your laptop, copies the new version to your $5 server, swaps it in and checks the site is up. If the check fails, the old build goes back on its own.
Laptop build → $5 server
Need a job every minute?Drop a file in a folder.
User joins? They get their welcome email instantly. Customer buys? Access is unlocked the second payment clears. Scheduled jobs and timely workers run right inside your app — no Inngest subscription, no Upstash QStash fees, zero cloud queues.
No Inngest or Upstash · 0 cloud queue bills
You want something to happen in the background.
A user signs up, a customer buys, an API drops, or a heavy AI summary runs. Your app never freezes — timely workers finish the job in milliseconds:
Pool: 4 threadsMax retries: 3 with backoff
Timely Worker Thread PoolACTIVE
[worker] timely pool active · 4 threads · local queue ready
[worker] user joined → dispatchJob('emails/welcome') → claimed thread #1
[worker] ✓ emails/welcome delivered in 18ms via Resend
Heartbeat: 30sZero stalled jobs
When someone buys
Their access unlocks and their receipt sends the second payment clears. If the payment gateway has a hiccup, it retries on its own.
When someone signs up
Their welcome email lands immediately. A friendly check-in sends two days later — with zero extra email subscriptions.
When an AI prompt runs
Whether a report or LLM task takes 5 seconds or 45 seconds, the page never spins or times out. It finishes quietly in the background.
Housekeeping on schedule
Your database takes a backup every night and cleans up old logs every Sunday. Set it once and never touch a server command.
BoringPush vs the hard way
A blank folder costs you weeks before anyone can pay you. Here's what you skip on day one.
Login, payments, analytics and feedback boards already working
BoringPushIncluded
ScratchNot included
StockNot included
Agent rules and skills for Claude Code, Cursor and Antigravity
BoringPushIncluded
ScratchNot included
StockNot included
One-command deploy that checks the site and rolls back on failure
BoringPushIncluded
ScratchNot included
StockNot included
Destructive database changes blocked before they ship
BoringPushIncluded
ScratchNot included
StockNot included
Runs on a $5 server with SQLite ($0 database bill)
BoringPushIncluded
ScratchNot included
StockNot included
Same data layer on SQLite, MongoDB and Supabase
BoringPushIncluded
ScratchNot included
StockNot included
Stripe, Lemon Squeezy and Dodo checkout
BoringPushIncluded
ScratchNot included
StockNot included
Analytics that tracks revenue, not just visits, with cookie-free mode
BoringPushIncluded
ScratchNot included
StockNot included
Nightly backups and cleanup with no Redis or cron service
BoringPushIncluded
ScratchNot included
StockNot included
Incident alerts to Telegram or Discord
BoringPushIncluded
ScratchNot included
StockNot included
A terminal command for every feature, with keys your AI agent can use
BoringPushIncluded
ScratchNot included
StockNot included
Works with Claude, ChatGPT and any MCP assistant, read-only by default
BoringPushIncluded
ScratchNot included
StockNot included
Magic links + Google sign-in
BoringPushIncluded
ScratchNot included
StockIncluded
Included on day one
BoringPush13 of 13
Scratch0 of 13
Stock1 of 13
What you pay
BoringPush$199 once
ScratchYour weeks
StockVaries
| Feature | BoringPushIncluded | From scratch | Starter template |
|---|---|---|---|
| Login, payments, analytics and feedback boards already working | Included | Not included | Not included |
| Agent rules and skills for Claude Code, Cursor and Antigravity | Included | Not included | Not included |
| One-command deploy that checks the site and rolls back on failure | Included | Not included | Not included |
| Destructive database changes blocked before they ship | Included | Not included | Not included |
| Runs on a $5 server with SQLite ($0 database bill) | Included | Not included | Not included |
| Same data layer on SQLite, MongoDB and Supabase | Included | Not included | Not included |
| Stripe, Lemon Squeezy and Dodo checkout | Included | Not included | Not included |
| Analytics that tracks revenue, not just visits, with cookie-free mode | Included | Not included | Not included |
| Nightly backups and cleanup with no Redis or cron service | Included | Not included | Not included |
| Incident alerts to Telegram or Discord | Included | Not included | Not included |
| A terminal command for every feature, with keys your AI agent can use | Included | Not included | Not included |
| Works with Claude, ChatGPT and any MCP assistant, read-only by default | Included | Not included | Not included |
| Magic links + Google sign-in | Included | Not included | Included |
| Included on day one | 13 of 13 | 0 of 13 | 1 of 13 |
| What you pay | $199 once | Your weeks | Varies |
StripeLemon SqueezyDodoPLAIN ENGLISHNO CODING REQUIREDROLLBACK BUILT IN
⚡
Safe ModePlain English Builder
Works with Cursor & Claude"Add a summer 20% discount code for new buyers..."✓ Checks passed
Type what you want in simple words. Guardrails: lint checks before deploy, read-only data for the AI, and automatic rollback if a deploy fails.
💳
0% Platform CutCollect Payments
3 Payment Rails Active
Stripe Checkout+$199.00
Webhook signature:✓ 200 Verified
Hidden middleman fees:$0 (You keep 100%)
💬
Built-inCustomer Feedback
Live Upvoting Boards
"Add team invites & seats"▲ 84
Build what paying users vote for
Replaces Canny / Featurebase:Saves $79/mo
✨
Google + Magic1-Tap Customer Auth
NextAuth v5 · JWT session
Continue with Google1 Click →
No passwords forgotten:$0 auth0 bills
🚀
● Live (0ms drop)In-Built Deploy
Local Build Swap ➔ VPS
PM2 Rolling Reload:✓ PID 2419 online
boringpush deploy · 65MB RAM idle
Hetzner / DO $51-second rollback
‹
✈
Boring Incident Botbot
bot · 2 members
🔍⋮
Today
Listening for errors & webhook failures...
scream() → your phone$0 / mo📁
$0 Egress BandwidthDirect File Uploads
Cloudflare R2 · S3 API
avatar_receipt.pdf✓ 100% Stored
Server RAM impact:0MB (Direct streaming)
One payment. Yours forever.
Most tools charge you every month before you've made a dollar. This is one payment: take payments, welcome customers, and own 100% of your software, with no subscription.
$199.00
- Start on SQLite. Switch to Supabase with one setting, same app code
- Built-in digital marketplace — list & sell products directly from Dashboard.
- Take credit cards & Apple Pay worldwide (Stripe, Dodo, Lemon)
- 0% platform take — all your earnings go straight to your bank
- 1-command deploy & rollback from your laptop or phone
- Live visitor analytics built in — goodbye PostHog & DataFast bills and cookie popups
- 1-tap Google customer login (zero per-user monthly fees)
- Customer feedback & upvoting board built in — goodbye Canny ($79+/mo) & Featurebase ($49+/mo)
- Direct photo & file uploads for your buyers ($0 egress via R2)
- Full source code included · $199 once · Yours forever
‹
✈
Boring Incident Botbot
bot · 2 members
🔍⋮
Today
Listening for errors & webhook failures...
scream() → your phone$0 / moFair questions, no pitching.
Have another one? Ask directly at [email protected]
Getting started
Accept the GitHub invite and the full source code lands in your own GitHub, with no licence server. Open the folder in Claude Code, Cursor, Antigravity or OpenCode and send it the setup message from the docs. Answer four questions (app name, domain, support email, database) and your agent sets up the app, runs the tests, prepares your server and does the first deploy, checking each step before the next.
Yes, for most early startups. It isn't a toy local mode: the same schema and queries run in production on SQLite with Write-Ahead Logging (WAL). Queries read a file on the same server, with no network round-trip, so a typical lookup takes well under a millisecond. One $5 VPS serves a small SaaS comfortably and saves you $30–$50/month in database bills before your first dollar. When you outgrow one server (lots of simultaneous writers, or users far apart), switch to Supabase or MongoDB.
Your app never talks to a database directly. It calls one small set of functions (create a user, find an order, list posts), and each database has its own version of those functions with the same names and the same fields. One setting, DB_PROVIDER, picks which version runs. A contract check (npm run test:matrix) confirms every database provides the full set. SQLite is the default and the one the end-to-end tests run on.
Your app code stays the same. Three steps: run the included schema.sql once in your Supabase project, then set DB_PROVIDER=supabase with your project URL and service key, then redeploy. Two things to know: your existing rows don't move by themselves (a new app starts empty, so usually there's nothing to move), and analytics stays in a SQLite file on your server either way. Everything that ships in the kit already works on all three. Features you add later are written for the databases you picked at setup, so before switching to a new one, ask your AI to add that database's version of them (the rules tell it how).
Yes. There's a full MongoDB version of every data function, with the same field names as SQLite and Supabase. Pick it during setup or set DB_PROVIDER=mongodb with your connection string. Most people start on SQLite and only move when they need a managed database.
Yes. SQLite needs a server with a disk, so on Vercel set DB_PROVIDER to supabase (or mongodb). The kit ships Supabase Postgres and MongoDB versions of every built-in data function, with the same field names, and npm run test:matrix checks that none is missing. Built-in features need no code changes; anything you add later needs its Supabase or MongoDB version too (your AI's rules cover this). Start for $0 on a VPS, or move to Vercel when you want serverless.
No, Docker is completely optional! You get the freedom to choose: 1) Bare-Metal Default: our Local Build Swap compiles on your fast machine, hot-swaps live in ~2s, and PM2 reloads with zero downtime. Your app idles at just 65 MB of RAM on any $5 Hetzner or DigitalOcean box. 2) Lean Container: if your fleet runs Docker or you want container isolation, we include a multi-stage Alpine standalone Dockerfile (slashed from 1.5GB down to 285MB, idling at ~67MB RAM) and Kamal-style zero-downtime shipping via 'boringpush docker ship'. Either way: zero hosted CI bills, zero lock-in.
No third-party CI to set up, no monthly runner fees, and no crashed $5 servers trying to compile Next.js. You run 'boringpush deploy' (or 'npm run bp -- deploy'). It runs a strict preflight gate (node --check and lint with zero warnings), compiles on your fast laptop cores via Local Build Swap, and delta-syncs only changed chunks to your VPS in ~2 seconds. The server performs an atomic swap with zero downtime PM2 reload, verifies live health (200 OK), purges Cloudflare edge cache for changed routes, and parks the previous build for instant rollback.
Run 'boringpush rollback'. Every deploy preserves the outgoing build in .next_prev. Rollback performs an atomic swap and PM2 reload that takes just 1 to 2 seconds: zero rebuild, zero re-upload, and your database volume is untouched. Your site is back to a healthy state before a single user notices.
They just run — quietly, on schedule, with nothing to babysit. One built-in worker (`boringpush worker`) handles hourly, daily, weekly, and monthly jobs: your database backs itself up every day and tidies itself every hour while you sleep. No extra server to host, no queue to monitor, no 2am page because a worker died.
Most of the time goes on getting your own keys (payments, email, Google login). The setup itself is one message to your AI editor: open the folder and say "Read SETUP.md from top to bottom and set this project up for me." It asks you four questions, then sets up the app, runs the tests and does the first deploy, checking each step. The weeks-long parts (checkout, webhooks, sessions, deploy) are already done.
Yes — this whole site runs on it. Click around: the boards, billing buttons, blog, and auth flows below are the product. The repo is the same code, plus setup docs.
Right here at /docs: thirteen short guides covering setup, structure, database switching, payments, paywall, security, and deployment. Every guide has its own share card, and the whole set reads in under an hour.
Payments
Whichever you already have. Stripe is the default and battle-tested. LemonSqueezy and Dodo work through the same checkout/portal routes — change BILLING_PROVIDER, point your webhooks, done.
The provider webhook verifies the signature, then grants access: hasAccess, customerId and billingProvider are set on the user. Failed or cancelled subscriptions revoke it automatically.
Because it's a digital product, all sales are final: once you have access to the code you can download it, so there's nothing to hand back. What you do get is help. If you're stuck or something doesn't work, email us and we'll sort it out, and we read every piece of feedback.
AI builders
Keep vibe coding. BoringPush is what you vibe code on top of. AI gets you a demo fast; the slow part is everything after: payments that record every sale, login that survives the next prompt, a database your agent can't wipe, and deploys that roll back on their own when something breaks. That part is done and tested here, and the agent rules stop your AI from undoing it. You spend your prompts on the idea, not on the plumbing.
BoringPush ships with 15 agent skills in .agents/skills/ that Claude Code, Cursor, Antigravity and OpenCode load automatically. Building: build-feature (data first, then route, then UI), deploy-app (release with rollback), mobile-session-guard (safe sessions from your phone) and responsive-ui. Working like a careful engineer: brainstorm-boring, plan-feature, execute-plan, debug-systematically, review-pass and verify-before-claim (no "done" without proof). Plus five boring filters for core rules, UI, copywriting, accessibility and mobile layout.
That's what it's built for. Load the build-feature skill and any agent works data-first: same provider interfaces, verified with lint + smoke, following CONVENTIONS.md instead of inventing structure.
The latest boring stack, no lag: Next.js 16 with React 19 and Auth.js v5. JWT sessions work identically on SQLite, MongoDB, and Supabase — Google OAuth, magic links, and the dev escape hatch all run through one config, fully smoke-tested. Total auth footprint: next-auth plus two tiny crypto libs (jose, hkdf). No Clerk, no hosted user service, no per-seat bill — and sessions survive deploys without forcing anyone to log in again.
No. Every builder knows the sickening feeling of asking an AI to add something simple, only to find it broke your login flow or payment webhook. BoringPush stops this with radical Locality of Behavior: every feature lives in its own sandboxed folder with thin routes and strictly additive database tables. When an agent creates a new feature, it is physically locked out of your working auth, checkout, or billing code. What works stays working.
Small modules, one job each: providers/db/* per database, providers/billing/* per gateway, one-line registries. Delete a folder + one line to remove a feature.
Stop burning weeks on plumbing. Start shipping
Every week on login, payments and servers is a week nobody can pay you. That part is done. Pay $199 once. Yours forever.