A production-ready Next.js starter you drive with Claude Code, Codex, or any coding agent —
ship a real website without first becoming a security engineer or a privacy lawyer.
Quickstart · Modules · The skills · Docs
Most starter templates hand you an empty app and wish you luck. vibe-starter is different: it is a secure base plus a library of feature modules, driven by coding agents that interview you about your business idea and assemble only the parts you actually need — with the legal pages, cookie consent, and security hardening already done the way a senior engineer would.
This is the main event. Run it inside Claude Code and the /vibe-starter skill interviews you
in plain English, then scaffolds a tailored, secure app — no boilerplate archaeology.
Using Codex, Cursor, or another agent? The same guardrails live in AGENTS.md,
and the vibe CLI composes modules straight from the terminal — so every agent keeps the code
secure and production-ready.
Every scaffold starts from the same secure, legally-complete base — themed, accessible, and deployable on its own:
See a full example: vibe-starter-demo is a SaaS scaffolded from this starter with auth, a dashboard, Stripe test-mode checkout, and a contact form.
| 🛡️ Secure by default | Nonce-based Content Security Policy, hardened headers, and Zod-validated inputs wired in before you write a line. |
| ⚖️ Legally complete | GDPR / CCPA privacy, terms, and cookie pages with a compliant, equal-weight consent banner — generated to match the data you actually collect. |
| 🧩 Only what you need | A secure base plus a registry of 24 modules the scaffolder pulls in on demand — auth, payments, AI, and more. |
| 🤖 Built to be prompted | Keep building by describing features in plain English while the skills keep the code production-ready. |
| 🔑 Typed environment | Env vars validated at build time; server secrets can never reach the client. |
| 🚦 Green from commit one | Strict TypeScript, ESLint, Prettier, secret scanning, and CI on every push. |
git clone https://github.com/Falcon305/vibe-starter my-app
cd my-app
pnpm install
cp .env.example .env.local
pnpm devPrefer a one-liner? This repo is a GitHub template — click Use this template above — and
create-vibe-app scaffolds the same thing from
the terminal.
Then, inside Claude Code, run the scaffolder and describe your business in plain English:
/vibe-starter
It figures out which modules you need, installs them, generates your legal pages, and leaves you
with a running, deployable app. Using another agent? Point it at AGENTS.md and let
it drive the vibe CLI.
The vibe CLI composes modules shadcn-style — it copies real source into your repo and rewires
dependencies, env, database schema, CSP, and legal pages to match.
| Skill | What it does |
|---|---|
/vibe-starter |
Interviews you and scaffolds a tailored app from your idea. |
/vibe-build |
Adds features by prompting while enforcing the security checklist. |
/vibe-security |
Audits the current app against the security baseline. |
/vibe-legal |
Regenerates legal pages when your data practices change. |
Run pnpm vibe list to see them, or let /vibe-starter pick. Twenty-four modules cover the full
stack — pick one db and one auth, add the rest as you need them.
| Group | Modules |
|---|---|
| Data & auth | db-drizzle-neon · db-supabase · auth-better-auth · auth-supabase · auth-clerk · auth-social · auth-passkeys · auth-2fa |
| App surface | dashboard · admin · teams-orgs · file-upload |
| Monetization & comms | payments-stripe · email-resend · notifications |
| Growth & content | waitlist · contact-form · blog-mdx · analytics-plausible · analytics-umami |
| AI, i18n & ops | ai-chat · i18n · monitoring-sentry · rate-limit-upstash |
See the module catalog for what each one provides and depends on.
pnpm vibe search auth
pnpm vibe add auth-better-auth dashboard
pnpm install
pnpm vibe doctorvibe update <module> pulls registry fixes into an installed module, and vibe doctor audits the
installed set for conflicts, drift, and leaked secrets.
Next.js 16 (App Router) · React 19 · TypeScript (strict) · Tailwind CSS v4 · shadcn/ui · Better Auth · Drizzle ORM · Postgres · Zod. Optimized for Vercel, self-hostable anywhere.
Browse it all at falcon305.github.io/vibe-starter-docs, or in the repo:
- Getting started — your first project, end to end
- Architecture — the base, the registry, and how the installer works
- Security model — CSP, headers, validation, and the threat model
- Module catalog & authoring guide
- CLI reference · skills · env vars
- Testing · deployment · troubleshooting