What it is
A reusable private-by-default boundary for temporary standalone Vercel apps that need one shared generated credential rather than public access.
Security starter · v0.1.0
A missing secret is not permission.
A small Vercel starter for private internal apps, demos, and spikes: scrypt credentials, signed expiring sessions, strict cookies, centralized rate limiting, and a fail-closed request boundary.
authentication Vercel TypeScript scrypt Upstash
scrypt
password envelope
__Host-
cookie boundary
503
missing config
Project notes
Fail-closed default
Missing authentication or rate-limit configuration returns 503. There is no environment flag that silently turns an intended private deployment public.
Executable proof
Tests exercise denial, login, cookie flags, tampering, expiry, protected assets, APIs, and downloads over the actual HTTP boundary.
Serverless-aware limiting
Login attempts use a centralized Upstash counter instead of isolated per-instance memory that resets across serverless invocations.
Deliberate limit
A shared login authenticates possession of one credential; it does not provide individual identity, per-person revocation, roles, row ownership, or MFA.
When to move on
Apps with customer data, durable production identity, or different user rights should use managed authentication and authorization rather than extending this starter.
Deployment fit
The starter is deliberately narrow: internal spikes, temporary standalone tools, and small trusted-group demos. A public static artifact or share-by-link page needs a different, explicitly public boundary.
Operational discipline
Credential generation, secret placement, deployment checks, and rotation are documented as one runbook. Development uses the real Vercel middleware boundary because a UI-only preview cannot prove authentication.
The repository documents the complete threat model, deployment and rotation runbook, runtime proof, and the boundary where managed accounts become the correct answer.