21 questions to ask a SaaS boilerplate before you pay for it
Feature lists are marketing. These are the twenty-one questions that separate a boilerplate you can build a business on from a demo with a login screen. They work on any kit — take them to whichever vendor you are evaluating, including this one.
Each question is followed by GoVueKit's answer, so the comparison is concrete.
Authentication
1. How are passwords hashed, with what parameters? Bcrypt with default cost is acceptable; anything home-made is not. GoVueKit: argon2id, 64 MiB memory, 3 iterations, per-password salt.
2. Do signup, login and password reset reveal whether an account exists? Different messages or timings are account enumeration. GoVueKit: neutral responses on all three, and a test that asserts it.
3. Where do sessions live, and what happens on password change? Stateless JWTs that cannot be revoked are a liability for a product with billing. GoVueKit: server-side sessions in the database; a password change terminates every other session.
4. Is there two-factor authentication, and does it cover every sign-in path? 2FA that guards the password form but not the magic link is theatre. GoVueKit: TOTP with ten single-use recovery codes, enforced on password, magic link and OAuth sign-in.
5. What happens when an OAuth email matches an existing account? Silent merging is an account-takeover vector. GoVueKit: no implicit merge; the user must sign in and link the provider explicitly.
Multi-tenancy
6. Where is the tenant boundary enforced?
"In the service layer" means "wherever someone remembered". GoVueKit: one
middleware resolves the organization against the caller's memberships, and
every business query filters on organization_id.
7. What does a request for another tenant's resource return? 403 confirms the resource exists. GoVueKit: 404, indistinguishable from a resource that never existed.
8. Is cross-tenant isolation tested end to end? Ask to see the test. GoVueKit: a Playwright journey creates two organizations and asserts the second cannot read the first — plus integration tests per endpoint.
9. Can roles be bypassed from the frontend? Every kit hides buttons; the question is what the server does. GoVueKit: RBAC is server-side middleware, frontend checks are explicitly cosmetic.
10. What protects the last owner of an organization? Products lose ownership when the last owner leaves. GoVueKit: the last owner cannot be demoted, removed, or leave without transferring ownership.
Billing
11. Are webhooks idempotent, and how? "We check if we already processed it" is not enough if the check and the write are in different transactions. GoVueKit: the event id is inserted with a primary key and the business write commits in the same transaction — the full pattern.
12. Is payload data trusted? A valid signature proves the sender, not that the state is current. GoVueKit: every object is re-fetched from the provider API by id; nothing beyond the id is trusted.
13. Who owns the subscription — the user or the organization? Per-user billing on a team product is a migration you will do later, painfully. GoVueKit: the organization owns it, and solo mode makes it per-user when that is what you want.
14. What happens when money leaves the account, and what would a second
provider cost? Most kits handle payment and stop there; refunds and
chargebacks arrive anyway. GoVueKit: Stripe only — charge.refunded stamps
the purchase rather than deleting it (the row reconciles with Stripe), and
charge.dispute.created is logged at Error level so it reaches your error
reporter. Stripe sits behind a five-method billing.Provider interface, so
another provider is a package to write, not a rewrite — but it is an
integration you would write, not a switch you flip.
15. Where do prices live? An admin UI that can disagree with what the payment provider charges is a bug generator. GoVueKit: plans are configuration, served to both the pricing page and the billing screen; the amount charged always comes from the provider.
Operations
16. What must be running in production besides the app and the database? Every additional service is an on-call surface. GoVueKit: nothing. The job queue is a table, sessions are rows, files can be on disk.
17. What happens to queued emails when you redeploy? In-memory queues lose them. GoVueKit: jobs are durable rows, claimed and retried after a restart.
18. How are errors reported, and can you swap the reporter?
GoVueKit: every Error-level log record reaches a pluggable reporter;
SENTRY_DSN enables the bundled one, and the interface is one method.
19. What does the deployment story look like, in commands?
If the answer is a platform button, ask what self-hosting takes. GoVueKit:
one binary, or docker compose -f docker-compose.prod.yml up -d --build with
Traefik and Let's Encrypt included.
The purchase itself
20. What exactly does the licence allow, and forbid? The clauses that matter: unlimited end products, client work, whether updates are perpetual, and the redistribution restriction. GoVueKit: perpetual, unlimited products including client work, lifetime updates; you may not republish the source as a competing kit.
21. How are updates delivered, and how do you merge them? A zip file is a fork you maintain alone. GoVueKit: a private repository you are invited to, with atomic conventional commits and a changelog — you pull, read the diff, merge.
The bonus question
Can you read the code before buying?
Most kits publish something: a demo repository, documentation, code excerpts,
a video walkthrough. A vendor that shows nothing is asking you to buy a
promise. GoVueKit publishes excerpts on the landing page and its
guides in the open at docs.govuekit.dev — including the ten-minute tour that
follows one request through every layer, from the chi route to the SQL and
back. The repository adds DECISIONS.md, which is the file to read second:
every non-obvious call, with its reasoning, including the features that were
built and then cut. And the site you are reading is served by the product
itself.
The questions worth asking about what is missing
A serious kit says no to things. Ask what a vendor deliberately left out and
why; "everything is included" is the answer of a product nobody has had to
maintain. GoVueKit: no code generator, no example business module, no second
payment provider, no passkeys, no feature flags — several of those existed and
were removed, and DECISIONS.md explains each cut. If your evaluation is
scored on feature count, that is a column GoVueKit loses on purpose.
How to use this list
Do not send all twenty-one questions to a vendor — you will get a marketing reply. Pick the five that map to your risk: if you sell to teams, ask 6, 7, 8; if you charge money, ask 11, 12, 14; if you have no ops team, ask 16, 17, 19.
And ask for the test, not the answer. "Where is the test that proves that?" is the single most useful sentence in this entire process.
Want the comparison by architecture rather than by feature? Read choosing a SaaS boilerplate in 2026.