Feature lists are marketing. These are the twenty-one questions that separate a
boilerplate you can build a business on from a demo with a login screen. They
work on any kit — take them to whichever vendor you are evaluating, including
this one.
Each question is followed by GoVueKit's answer, so the comparison is concrete.
Authentication
1. How are passwords hashed, with what parameters?
Bcrypt with default cost is acceptable; anything home-made is not. GoVueKit:
argon2id, 64 MiB memory, 3 iterations, per-password salt.
2. Do signup, login and password reset reveal whether an account exists?
Different messages or timings are account enumeration. GoVueKit: neutral
responses on all three, and a test that asserts it.
3. Where do sessions live, and what happens on password change?
Stateless JWTs that cannot be revoked are a liability for a product with
billing. GoVueKit: server-side sessions in the database; a password change
terminates every other session.
4. Is there two-factor authentication, and does it cover every sign-in
path? 2FA that guards the password form but not the magic link is theatre.
GoVueKit: TOTP with ten single-use recovery codes, enforced on password,
magic link and OAuth sign-in.
5. What happens when an OAuth email matches an existing account?
Silent merging is an account-takeover vector. GoVueKit: no implicit merge; the
user must sign in and link the provider explicitly.
Multi-tenancy
6. Where is the tenant boundary enforced?
"In the service layer" means "wherever someone remembered". GoVueKit: one
middleware resolves the organization against the caller's memberships, and
every business query filters on organization_id.
7. What does a request for another tenant's resource return?
403 confirms the resource exists. GoVueKit: 404, indistinguishable from a
resource that never existed.
8. Is cross-tenant isolation tested end to end?
Ask to see the test. GoVueKit: a Playwright journey creates two
organizations and asserts the second cannot read the first — plus integration
tests per endpoint.
9. Can roles be bypassed from the frontend?
Every kit hides buttons; the question is what the server does. GoVueKit: RBAC
is server-side middleware, frontend checks are explicitly cosmetic.
10. What protects the last owner of an organization?
Products lose ownership when the last owner leaves. GoVueKit: the last owner
cannot be demoted, removed, or leave without transferring ownership.
Billing
11. Are webhooks idempotent, and how?
"We check if we already processed it" is not enough if the check and the write
are in different transactions. GoVueKit: the event id is inserted with a
primary key and the business write commits in the same transaction —
the full pattern.
12. Is payload data trusted?
A valid signature proves the sender, not that the state is current. GoVueKit:
every object is re-fetched from the provider API by id; nothing beyond the id
is trusted.
13. Who owns the subscription — the user or the organization?
Per-user billing on a team product is a migration you will do later, painfully.
GoVueKit: the organization owns it, and solo mode makes it per-user when that
is what you want.
14. What happens when money leaves the account, and what would a second
provider cost? Most kits handle payment and stop there; refunds and
chargebacks arrive anyway. GoVueKit: Stripe only — charge.refunded stamps
the purchase rather than deleting it (the row reconciles with Stripe), and
charge.dispute.created is logged at Error level so it reaches your error
reporter. Stripe sits behind a five-method billing.Provider interface, so
another provider is a package to write, not a rewrite — but it is an
integration you would write, not a switch you flip.
15. Where do prices live?
An admin UI that can disagree with what the payment provider charges is a bug
generator. GoVueKit: plans are configuration, served to both the pricing page
and the billing screen; the amount charged always comes from the provider.
Operations
16. What must be running in production besides the app and the database?
Every additional service is an on-call surface. GoVueKit: nothing. The job
queue is a table, sessions are rows, files can be on disk.
17. What happens to queued emails when you redeploy?
In-memory queues lose them. GoVueKit: jobs are durable rows, claimed and
retried after a restart.
18. How are errors reported, and can you swap the reporter?
GoVueKit: every Error-level log record reaches a pluggable reporter;
SENTRY_DSN enables the bundled one, and the interface is one method.
19. What does the deployment story look like, in commands?
If the answer is a platform button, ask what self-hosting takes. GoVueKit:
one binary, or docker compose -f docker-compose.prod.yml up -d --build with
Traefik and Let's Encrypt included.
The purchase itself
20. What exactly does the licence allow, and forbid?
The clauses that matter: unlimited end products, client work, whether updates
are perpetual, and the redistribution restriction. GoVueKit: perpetual,
unlimited products including client work, lifetime updates; you may not
republish the source as a competing kit.
21. How are updates delivered, and how do you merge them?
A zip file is a fork you maintain alone. GoVueKit: a private repository you
are invited to, with atomic conventional commits and a changelog — you pull,
read the diff, merge.
The bonus question
Can you read the code before buying?
Most kits publish something: a demo repository, documentation, code excerpts,
a video walkthrough. A vendor that shows nothing is asking you to buy a
promise. GoVueKit publishes excerpts on the landing page and its
guides in the open at docs.govuekit.dev — including the ten-minute tour that
follows one request through every layer, from the chi route to the SQL and
back. The repository adds DECISIONS.md, which is the file to read second:
every non-obvious call, with its reasoning, including the features that were
built and then cut. And the site you are reading is served by the product
itself.
The questions worth asking about what is missing
A serious kit says no to things. Ask what a vendor deliberately left out and
why; "everything is included" is the answer of a product nobody has had to
maintain. GoVueKit: no code generator, no example business module, no second
payment provider, no passkeys, no feature flags — several of those existed and
were removed, and DECISIONS.md explains each cut. If your evaluation is
scored on feature count, that is a column GoVueKit loses on purpose.
How to use this list
Do not send all twenty-one questions to a vendor — you will get a marketing
reply. Pick the five that map to your risk: if you sell to teams, ask 6, 7, 8;
if you charge money, ask 11, 12, 14; if you have no ops team, ask 16, 17, 19.
And ask for the test, not the answer. "Where is the test that proves that?" is
the single most useful sentence in this entire process.
Want the comparison by architecture rather than by feature? Read
choosing a SaaS boilerplate in 2026.
Originally published on govuekit.dev. GoVueKit is a complete Go + Vue 3 SaaS codebase you buy once and own; the whole stack runs on your machine with one docker compose up: https://govuekit.dev/labs
Top comments (2)
Turning the evaluation into questions a buyer can take to any vendor is a smart format, and the account enumeration one is something most kits quietly fail. I'd add a question about how painful it is to rip out the billing layer if you outgrow it, since that's usually where the lock-in shows up a year later.
Framing it as twenty-one questions instead of a feature list is the useful part, especially the ones about account enumeration and whether sessions die on password change. Which of the twenty-one has actually made you walk away from a kit you were about to buy?