What we learned reviewing 162 boilerplates: the numbers and the red flags

By Charanjit Singh · Updated 29 Oct 2026

Disclosure: Top Boilerplates is run by the maker of IndieKit, a paid Next.js boilerplate. IndieKit isn't discussed in this article, and it gets the same listing treatment as every other kit.

Every listing on this site gets the same treatment: facts pulled from the kit's own repo, docs and pricing page, then a written verdict, and an adversarial fact-check against the source before it's published. After doing that 162 times, some patterns are hard to miss. This is the aggregate picture as of 29 October 2026, followed by the red flags that came up often enough to be worth checking on any kit you're considering - including ones we don't list.

The numbers

• 162 published kits across 26 frameworks. Next.js leads with 21, then React, Laravel, Rails and WordPress at 10-11 each. Half (81) are SaaS starters; the rest are dashboards, e-commerce, landing pages, AI apps and mobile.
• 77 are free, 51 paid and 34 freemium. 60 have no public GitHub repository - you evaluate them from a demo, docs and screenshots.
• Of the 91 kits with a public commit history, 56 had a commit in the last 90 days and only 4 have gone more than a year without one. Abandonment is rarer than directory lists suggest; quiet half-maintenance is more common (see below).
• Among the 81 SaaS kits, Stripe ships in 40. Paddle (9), Lemon Squeezy (7), Polar (6) and Dodo Payments (2) trail well behind, so if you need a merchant of record for EU VAT, your shortlist gets short fast - see Stripe-ready kits for the other side.
• Only 20 kits in the directory are multi-tenant (organizations, roles, per-org billing). If you're building B2B, that filter alone removes most options - the multi-tenant collection is the short list.
• Agent-instruction files are still rare: only a handful of kits ship a CLAUDE.md or AGENTS.md, despite how many market themselves as AI-ready. The AI-friendly collection lists the ones that do.

Red flag 1: a license narrower than the price suggests

A one-time price looks simple until you read who and what it covers. supastarter licenses per framework: one purchase covers one developer on one stack, so a team working across two frameworks pays more than the headline number. That's a legitimate model, but it's the kind of thing you want to know before checkout, not after. Look for: seats, frameworks or projects per license, whether client work is allowed, and whether you can ever open-source what you build on it.

Red flag 2: no code to read and no refund

A private repository isn't a problem by itself - plenty of good paid kits work that way. The combination is what hurts: no public code and no refund once access is granted means you're buying on the strength of a landing page. ShipFast is the best-known example; its listing notes that the repos linked from its own docs return 404. If a kit won't show code, weigh its demo, docs depth and changelog more heavily, and check the refund terms first.

Red flag 3: demo defaults that ship to production

Admin templates often run on mock data so the demo works without a backend. That's fine until the mock switch is on in the production config. Naive UI Admin - a well-maintained, MIT-licensed Vue template - sets VITE_USE_MOCK=true in .env.production, so a production build ships fake data and the mock libraries unless you turn it off. The same pattern shows up in paid front-end bundles like shadcn/studio Templates, whose admin template runs on a mock API. Grep the env files before you deploy anything you didn't write.

Red flag 4: activity that's mostly bots

"Last commit: 3 days ago" can mean a maintainer shipped something, or that Dependabot bumped a version. On the Full Stack FastAPI Template - one of the best-maintained free starters we list - the most recent commits were automated dependency and release-note updates, with the last human-authored change about two weeks earlier. That's healthy there, but on smaller projects bot commits can hide months of real silence. Open the commit list, not just the date badge.

Red flag 5: the vendor's own pages disagree

We hit this more than expected. shadcn/studio's template FAQ says templates aren't sold individually while its checkout sells them for $59 and up, and its pricing table and FAQ describe the cheapest plan differently. TanStack Starter Kit's payments docs are written around Stripe while its homepage feature list names Polar. Neither is necessarily bad faith - docs drift - but when the pages disagree, ask the vendor which one is true before you pay, and assume the codebase follows whichever was updated last.

Red flag 6: one maintainer carrying everything

Contributor graphs tell you how much risk you're taking on. Naive UI Admin's maintainer has 220 commits; the next contributor has 8. That's not a reason to avoid it - many excellent kits are one-person projects - but it is a reason to read the code well enough that you could maintain your fork alone if updates stop.

Red flag 7: "reviews" written by competitors

When we went looking for independent opinions on shadcn/studio, the only detailed review turned out to be written by the founder of a competing library, which it ranked first - with no disclosure in the post. Boilerplates are a small market and most comparison content is written by someone selling one. Check who wrote a review before you weigh it. (We're no exception: this site's maker also sells a kit, which is why every page here carries the disclosure above.)

Red flag 8: an "AI-ready" claim with nothing behind it

Many kits now market MCP servers, agent rules or "AI-optimized" codebases. Some genuinely ship instruction files and typed, documented structure; others mean a sentence on the landing page. MakerKit, for instance, leans on its agent tooling in marketing while the free tier ships less of it. If AI-assisted development matters to you, look for actual CLAUDE.md, AGENTS.md or rules files in the repo, plus strict TypeScript and tests - those are what make an assistant useful in an unfamiliar codebase.

A 10-minute check before you buy

• Read the license page for seats, frameworks, client work and open-sourcing.
• Find the refund policy, especially if the code is private.
• Open the commit history and look for human-authored changes in the last few months.
• Grep env files and config for mock, demo or seed switches.
• Compare the homepage feature list with the docs for payments, auth and hosting - note any mismatch.
• Check the contributor graph and decide whether you could maintain a fork yourself.
• Look for instruction files and tests if you'll build with an AI assistant.

For the structural questions - tenancy, architecture weight, hosting lock-in - see how to choose a SaaS boilerplate. Every kit mentioned here has a full listing with a verdict, pros and cons, and live freshness data, and the SaaS boilerplates page has the rest.