Why ShipAnvil exists

I have been building Symfony applications for fifteen years. Long enough to have written the same first three weeks of every SaaS project many times over: registration, email verification, password reset, login throttling, two-factor auth, an organizations model, Stripe webhooks, an admin panel, transactional emails, a deploy recipe. None of it is the product. All of it is mandatory.

The Next.js world solved this years ago — boilerplates like ShipFast have thousands of customers because skipping those three weeks is obviously worth a couple hundred dollars. So when I decided to ship my own products on Symfony, I went shopping for the equivalent.

What I found

As of June 2026, the state of the Symfony boilerplate market was bleak:

• One promising kit's domain now serves a cosmetics shop.
• The most feature-complete option hadn't seen a commit in twelve months, and its website no longer resolves.
• One project pivoted to free open-source bundles — genuinely useful, but auth plus tooling is not a SaaS: no billing, no tenants, no admin.
• The one commercial option still alive had no public docs (the docs link 404'd), no demo, no 2FA, no teams, and no written license.

Nobody was treating "the first three weeks of a Symfony SaaS" as a product worth doing properly. I wrote up the details in an honest comparison of every option, including the ones I'm competing with.

What "properly" means

The gap in this market is not features — it's trust. A boilerplate is code you put at the very bottom of your business. You will build on top of its auth, route money through its webhooks, and grant its admin panel to your support staff. "It worked in the demo video" is not a standard for any of that.

So ShipAnvil is built to the standard I'd demand from a senior hire:

• 324 functional tests, 1,368 assertions, run on every commit — including complete billing lifecycles replayed from signed webhook fixtures, for Stripe and Lemon Squeezy. The money paths are the most-tested code in the kit, because they're the paths you can least afford to guess about.
• PHPStan at level max, zero errors, strict types everywhere. Not because the badge is pretty, but because every loose type in a foundation becomes a runtime surprise in someone's product.
• Security as a feature, not a checkbox: TOTP two-factor with hashed backup codes, mandatory email verification, login throttling, rate limits on every email-sending endpoint, a nonce-based Content Security Policy.
• A real deploy story: a step-by-step recipe for a plain Linux VPS (the cheapest, most boring hosting there is) plus Docker images if that's your thing. A SaaS kit that ends at symfony server:start is a demo.
• Multi-tenancy from day one, because retrofitting organizations into a users-only schema is the single most painful migration in SaaS. Every tenant-owned query is scoped by a Doctrine filter, automatically.
• AI-native: a Claude API client with streaming and structured extraction, with usage quotas wired into the billing plans. In 2026, "we'll add AI later" is how products lose.

Proof over promises

Two decisions follow directly from the trust problem.

First, this website runs on ShipAnvil. The landing page, the pricing page, this blog post, the checkout you'd buy it through, the demo account — all of it is the kit, deployed with the kit's own deploy recipe. If you want to know what you're buying, you're looking at it.

Second, there's a live demo with real seeded data — not screenshots, not a video. Log in, poke the admin, trip the 2FA, read the invoices.

Where this is going

ShipAnvil v1.0 ships complete: auth, organizations, billing on two providers, admin, emails, AI module, landing kit, deploy recipes, and the test suite that holds it together. The roadmap is driven by one rule — I build my own products on this kit, so every friction I hit becomes a fix you get.

The first fifty copies go out as an early-bird at 149 €. The pricing page has the details, and the demo is open. If you've written those same three weeks as many times as I have, you know exactly what you're skipping.