npm supply-chain attacks and your website
What an npm supply chain attack is, how recent incidents reached ordinary websites, and the build settings we use to keep a Next.js site safe.
Web app or SaaS
Web app development, from SaaS MVP to launch
Web app and SaaS development from MVP to launch. We research your users, design the screens and build accounts, roles, billing, dashboards and integrations. The price covers a first version, the MVP, that runs in the browser. Native mobile apps are not included.
15 screens included
Who it's for
For founders and teams that need a working first version, an MVP, in the browser, with real users signing in.
- Founders launching a SaaS MVP to their first customers
- Teams replacing spreadsheets and email with a proper tool
- Companies building a customer or partner portal
- Products that need accounts, roles, billing and dashboards
Probably not a fit if
- You need native iOS or Android apps
- The feature list is large and fixed, with no first version in mind
What's included
- User research and MVP flows, tested on a clickable prototype
- UX/UI design of every screen, with a component library
- Accounts, sign-in and roles for your users and admins
- Subscriptions and billing through a payment provider
- Dashboards and data views for your users
- Integrations with the tools you already use, agreed in discovery
- Automated tests, a security review and a staging environment
Not included
| Item | If you need it | Price |
|---|---|---|
| Native iOS or Android apps | Quoted separately | Quoted |
| Features beyond the agreed MVP | Priced in a change note before any work | Quoted |
| Brand identity for the product | Add brand identity | $3,500 |
| An AI chat assistant in the app | Add the AI chatbot | $4,500 |
| Support and updates after launch | Add a care plan | $1,500 |
SaaS development: accounts, billing and roles
Every SaaS needs the same foundations before its main feature can earn money. They are part of the MVP price.
The MVP starts at $25,000 and takes 12-16 weeks. Extra screens are priced in the calculator.
| Foundation | What we build | What your users get |
|---|---|---|
| Accounts | Sign-up, sign-in and password reset, by email or Google | A safe way in, on any device |
| Roles | Owner, admin and member roles with permissions per screen | Teams that share one account safely |
| Billing | Plans, trials and invoices through Stripe or Paddle | Self-serve upgrades and receipts |
| Dashboards | Data views and reports for your users | Their numbers at a glance |
| Admin | An internal view to manage users and plans | Your team helps customers without touching the database |
How we build it
One team takes the product from research to launch, so nothing is lost between design and code.
UX/UI design
User research and usability tests on a clickable prototype are included, so the build starts from what users need, not from guesses.
Your stack, your choice
We recommend a stack in discovery and you pick: Next.js or Nuxt for the front end, NestJS, Hono or Express for the API, PostgreSQL or MongoDB for data, Vercel or AWS for hosting. All of it is mainstream, so your future developers will know it.
Headless CMS, if you need one
Most apps do not need one. If your app has marketing or help pages, add CMS setup ($2,000) so your team can edit them.
Multilingual
Each extra language translates the interface, emails and error messages, with dates and numbers formatted for each country.
AI features in your product
When your product needs them, we build AI features into it: summaries, search over your own data, and extraction from documents and photos with vision and OCR. You choose the model (Claude, Gemini or OpenAI), billed to your account.
- Front end
- Next.js
- Nuxt
- React
- Vue 3
- TypeScript
- TanStack Table
- React Hook Form
- Back end and APIs
- NestJS
- Hono
- Express
- REST
- OpenAPI
- WebSockets
- Auth and sign-in
- Auth.js
- Keycloak
- AWS Cognito
- Google sign-in
- Microsoft Entra ID
- OpenID Connect
- Email and notifications
- Resend
- SendGrid
- Telegram bots
- Microsoft Teams
- Integrations
- Salesforce
- n8n
- Elasticsearch
- Typesense
- Google Calendar
- GitHub API
- Data
- PostgreSQL
- MongoDB
- Redis
- pg-boss
- Drizzle ORM
- AI
- Anthropic Claude API
- Google Gemini API
- OpenAI API
- RAG with embeddings
- AI vision and OCR
- Payments
- Stripe
- Paddle
- Cloud and infrastructure
- AWS Lambda
- Terraform
- Docker
- Vercel
- GitHub Actions
- Quality and observability
- Vitest
- Playwright
- Testcontainers
- OpenTelemetry
- Sentry
- Security and supply chain
- SBOM
- CycloneDX
- SPDX
- CVSS
- EPSS
- CSAF
- dependency scanning
Timeline, revisions and price
Extra screens and each extra language add time. The MVP scope is agreed in writing before the build starts.
Research and flows · 2 weeks
› Your sign-off: User flows and MVP scope
UX/UI design · 3 weeks
› Your sign-off: Every screen, tested on a prototype
Build in two-week sprints · 5 weeks
› Your sign-off: Working features on staging each sprint
QA and security · 1 week
› Your sign-off: Test and security report
Launch · 1 week
› Your sign-off: Live app and handover
Revisions and sign-off
- Three revision rounds per stage.
- You approve the MVP scope in writing before design starts.
- During the build you review working features on staging every two weeks.
- Changes after sign-off go through a priced change note.
Screens
Questions about web apps and SaaS
What is an MVP, and why does the price cover one?
An MVP is the smallest version of your product that real users can sign up for and use. Starting there gets you feedback months earlier, and the price stays fixed because the scope is agreed in writing.
Do you build native mobile apps?
Not in this product. We build web apps that work in any browser, including on phones. If you later need iOS or Android apps, the same backend can serve them, and we quote them separately.
What counts as a screen in a web app?
One distinct view, such as sign-in, dashboard, settings or a list of records. The base price includes fifteen. Empty, loading and error states belong to their screen.
Who owns the app's code and user data?
You do. The repository, database, hosting and payment accounts are in your name from day one, and we work in them as invited users.
Further reading
Website security checklist: CSP, HSTS, headers
A website security checklist for marketing sites: HTTPS and HSTS, a working Content Security Policy, the other headers that matter, forms and dependencies.