Notes on building Groundrun

Deep technical write-ups on the decisions that go into a paid Next.js SaaS boilerplate built for Claude Code users. One article per shipped milestone.

Multi-tenant Prisma 7 without database row-level security — and the race condition my first cut introduced
A query-layer enforcement pattern using Prisma 7's $extends, the pre-check vs post-check split that closes the write race, and the gotcha that gets caught only by running a second-pass review on your own fix.
13 May 202614 min read
How I picked 4 MCP servers for a Next.js SaaS boilerplate — and why I dropped the official Postgres one
A token-budget framework, the four MCPs that earned a default slot, and a Datadog-disclosed SQL injection that killed the most-downloaded Postgres MCP in the ecosystem.
13 May 202612 min read

Notes on building Groundrun

Multi-tenant Prisma 7 without database row-level security — and the race condition my first cut introduced

How I picked 4 MCP servers for a Next.js SaaS boilerplate — and why I dropped the official Postgres one