Most AI-built SaaS apps don't start from a blank file. They start from a starter template — clone, rename, add features, ship. So I ran a local launch-readiness scanner (ai-saas-guard, 65 deterministic rules, no LLM) over 8 of the most popular open-source starters for Next.js + Supabase + Stripe apps — official vendor templates and widely used community boilerplates alike.
196 findings in total. 7 of the 8 templates had at least one critical or high-severity pattern. Here's what kept showing up.
The only critical findings in the whole run were in one widely cloned Stripe + Supabase template: its starter schema creates broad row-level-security policies (things like "allow all operations for authenticated users") so the demo works out of the box.
That's a reasonable trade-off for a teaching template. The problem is what happens next: an AI assistant scaffolds your app on top of it, you add your tables next to theirs, and the demo policy ships to production unchanged. RLS that lets every signed-in user touch every row is the single most common real-world Supabase incident — and it starts here, as a default.
16 findings across the starters were stripe.webhook.missing-critical-event — webhook handlers that listen for checkout but never handle the events that revoke access (subscription deleted, payment failed). Add missing signature verification and missing idempotency from the wider rule set, and you get the classic launch week story: a user cancels, keeps access forever; or a forged webhook grants a plan nobody paid for.
19 findings were production code paths containing mock or demo data fallbacks, plus 7 hardcoded fallbacks and more swallowed errors. Starters include demo data so the UI renders before you've wired a database. In production, the same pattern means: the payment provider times out, your API returns a cheerful success with sample data, and nobody finds out until a customer complains.
None of these are exotic. All of them are one-line-to-one-hour fixes — if somebody looks before launch.
Templates are doing their job: get you running fast. Security hardening is deliberately left as an exercise. The failure mode is new: when an AI writes most of the code on top of the template, there is no human left who remembers which parts were demo trade-offs. The person "reviewing" the PR sees working features, green tests, and no reason to open the migration file from three weeks ago.
That's the gap a launch gate is for. Not a full security audit — a short, deterministic checklist run at the one moment it matters: before the first real users arrive. Scan your starter before you build on it, and scan again before you ship:
npx ai-saas-guard@latest scan --root /path/to/your-saas
If you build on a starter, I'd love to hear: did you re-check the template's defaults before launch, or did they ship as-is?