Starter kits get judged on what they include. I think they should get judged on what they leave out, because every feature you ship is a feature you maintain — and your buyer inherits that maintenance.
Here's what my Laravel + React SaaS starter kit deliberately does NOT have, and the reasoning for each:
No password reset. It's the most-requested feature I get. But password reset is a project-shaped decision, not a kit-shaped one: token expiry times, email templates, mail providers, rate limiting on the forgot-password endpoint, fronted by your actual domain. Every implementation I've seen in a boilerplate was ripped out on day one. I'd rather ship a login page with one less link than a reset flow you'll delete.
No email verification. Same logic. Verification gates your registration flow to your mail setup, and half the side projects that buy starter kits are demos or internal tools where forced verification is friction with no payoff. The user model carries email_verified_at (Laravel convention, costs nothing), but nothing enforces it.
No subscriptions table, no Stripe SDK. Billing is the fastest-moving, most project-specific part of a SaaS. Paddle vs Stripe vs Lemon Squeezy, plans, trials, webhooks, proration — there is no "generic" billing integration that survives first contact with a real pricing page. A kit that ships one forces the buyer to unlearn it. My kit's role column and the admin user-management CRUD are the foundation billing gets built on, not billing itself.
What DID make the cut is the stuff that's identical in every project I've ever built: Sanctum auth (register/login/logout/me, with register returning a token), FormRequest validation, API resources, role middleware, the axios client with token and 401 interceptors, the auth loading gate, protected/admin routes, and a demo-mode mock so the preview runs with no backend.
The rule I use: if a feature's implementation depends on a decision the buyer hasn't made yet, it doesn't belong in the kit. Auth shape doesn't depend on your business. Your mail provider does. Your pricing model does.
Kits are supposed to save you a week, not hand you a second codebase to delete from. If that philosophy sounds right, the kit is here: https://kamranofficial.gumroad.com/l/mhekoig. $19, one-time — and yes, you'll still need to build password reset yourself. That's the point.
Top comments (0)