Reusable Next.js 16 + TypeScript template for launching new web apps with a secure default baseline.
Canonical URL placeholder: {{CANONICAL_URL}}
npm i
npm run init:template
npm run devRun baseline checks:
npm run lint
npm test
npm run build:secureMinimal required for local development: none.
Optional default values live in .env.example:
NEXT_PUBLIC_SITE_URLfor canonical/metadata URLsNEXT_PUBLIC_FEATURE_*flags for enabling optional feature surfaces- Integration secrets only when turning on related features
Integrations are included as optional modules behind feature flags:
- Supabase (
SUPABASEfeature) - Turnstile (
TURNSTILEfeature) - Upstash rate limiting (
UPSTASHfeature) - Vercel Analytics (
NEXT_PUBLIC_VERCEL_ANALYTICS_ENABLED=1)
- In CI/deploy, set
NEXT_PUBLIC_SITE_URL(orSITE_URL) to your production canonical URL. build:secureenforces no sourcemaps in build artifacts and checks for server-env leakage.- Keep public feature flags disabled by default; enable per app needs.